TFTP:
Enumeration
Guides for testing anonymous TFTP access and retrieving files
TFTP Anonymous File Enumeration
Enumerate files accessible via unauthenticated TFTP using UDP/69, leveraging the protocol's lack of authentication to identify exposed files and misconfigurations.
TFTP enumeration works differently from most services because the protocol has no directory listing capability. You discover files by requesting them directly, so enumeration is really a targeted file retrieval exercise. Common filenames like running-config, startup-config, backup.cfg, and phone configuration files (SEP*.cnf.xml for Cisco IP phones) are the standard starting wordlist.
TFTP runs on UDP port 69 with no authentication. If the service is accessible, anyone can request files. Nmap's tftp-enum script automates the process of cycling through common configuration filenames. Network devices frequently use TFTP for firmware updates and configuration backups, so a TFTP server on the network often contains router configs, switch configs, and VoIP phone provisioning files.
Extracted configuration files regularly contain plaintext or weakly hashed credentials, SNMP community strings, VPN pre-shared keys, and network topology details. A single TFTP hit can shortcut hours of scanning and enumeration on other services.