FTP anonymous access is a common misconfiguration that allows anyone to log into an FTP server without credentials. When enabled, attackers can browse directories, download files, and sometimes upload malicious content. Enumerating and exploiting anonymous FTP access is an essential skill in network pentesting because many legacy systems and poorly configured servers still expose it.

Anonymous access typically uses:

• Username: anonymous

• Password: anonymous or any email address

If accepted, the server treats the user as a low-privilege guest, but misconfigured permissions often expose sensitive data.

Identifying FTP Anonymous Access

FTP runs on port 21. The first step is checking whether the server allows anonymous login.

Checking FTP Banner

nc -nv 10.10.10.5 21

Banner output may reveal:

• FTP server software

• Version

• System type

This helps identify known vulnerabilities.

Attempting Anonymous Login

ftp 10.10.10.5

When prompted:

Name: anonymous
Password: anonymous

If login succeeds, anonymous access is enabled.

Enumerating Directories and Files

Once logged in, pentesters inspect the directory structure for sensitive information.

Listing Files

ls -la

Files that commonly expose information include:

• Backups

• .txt files with credentials

• Configuration files

• Web directories

• Logs

Navigating Directories

cd foldername

Pentesters search for hidden or sensitive paths. Misconfigured servers often leave development files or outdated backups.

Downloading Files for Analysis

get filename

After downloading, pentesters inspect files for:

• Hardcoded passwords

• API keys

• SSH private keys

• Database credentials

• Internal hostnames

Even seemingly harmless files can reveal internal structure.

Identifying Writable Directories

Writable directories are high-risk because attackers may upload malicious files.

Checking Write Permission

put test.txt

If the upload succeeds, the directory is writable.

Writable directories enable attacks such as:

• Planting web shells (when FTP maps to a web root)

• Overwriting configuration files

• Dropping payloads for later exploitation

Pentesters must ensure this action is permitted in scope.

Exploiting FTP for Web Shell Access (If FTP is mapped to web root)

If the FTP root corresponds to a website directory:

put shell.php

This provides remote code execution when visiting:

http://10.10.10.5/shell.php

This technique is only allowed when explicitly authorized.

Checking for Directory Traversal Weaknesses

Some FTP servers allow traversal patterns.

cd ../../

If traversal succeeds, it may expose system directories or sensitive files outside the intended area.

Using Nmap for FTP Enumeration

nmap --script ftp-anon -p21 10.10.10.5

This automatically checks anonymous access.

Checking for FTP Bounce Vulnerability

nmap --script ftp-bounce -p21 10.10.10.5

Bounce attacks allow port scanning other hosts through the FTP server.

Passive Mode vs Active Mode Behavior

FTP behaves differently in passive and active modes. Testing both modes reveals firewall behavior.

Passive Mode Test

passive

Some firewalls block passive connections, exposing filtering rules.

Identifying Misconfigurations

Pentesters look for:

• Anonymous login enabled

• Writable directories

• Sensitive files exposed

• Web directories accessible via FTP

• FTP bounce vulnerability

• Outdated FTP server versions

• Weak permission structures

Any of these may lead to unauthorized access or further exploitation.

Why FTP Anonymous Access Matters

Anonymous FTP access creates major security risks. It exposes files, configurations, and internal information. Writable directories can lead to remote code execution. Even read-only access reveals sensitive data that supports privilege escalation, lateral movement, and enumeration of internal systems.

Intel Dump

• FTP anonymous access allows login without credentials

• Enumeration includes listing files, directories, and permissions

• Writable directories enable exploitation

• Tools include ftp client, nc, and Nmap scripts

• Misconfigurations expose sensitive files or enable code execution