Home > Network Pentesting

FTP, SSH, RDP Enumeration

FTP, SSH, and RDP are common remote access services found across networks. Enumerating them helps pentesters understand authentication methods, configuration settings, exposed features, and potential weaknesses. Each service behaves differently and leaks different types of information. Proper enumeration reveals misconfigurations, weak security practices, and attack paths for exploitation.

FTP Enumeration

FTP operates on port 21 and often leaks sensitive information due to weak configurations or outdated servers. Enumeration focuses on login behavior, directory access, banners, and service features.

Checking FTP Banner

nc -nv 10.10.10.5 21

FTP banners often reveal:

  • Server software

  • Version numbers

  • Operating system identifiers

These details help identify vulnerabilities.

Checking for Anonymous Login

ftp 10.10.10.5

Login attempt:

Name: anonymous
Password: anonymous

If successful, anonymous FTP may expose:

  • Public files

  • Backups

  • Configuration files

  • Sensitive documents

Listing Directories

Inside FTP:

ls -la

Pentesters check permissions, file names, and writable directories. Misconfigured directories may allow uploading malware or web shells.

Passive and Active Mode Behavior

Passive mode (PASV) and active mode (PORT) behaviors reveal firewall configurations. Testing both modes helps understand how traffic flows through the environment.

SSH Enumeration

SSH runs on port 22 and provides encrypted remote access. Enumeration focuses on banners, authentication methods, supported algorithms, and key details. SSH misconfigurations can expose sensitive data.

Checking SSH Banner

nc -nv 10.10.10.5 22

SSH banners often reveal:

  • OS (e.g., Ubuntu, FreeBSD, Debian)

  • OpenSSH version

  • Patch level hints

This information is important for vulnerability checks.

Testing Authentication Methods

ssh -vvv user@10.10.10.5

The verbose output reveals:

  • Supported authentication (password, public key, keyboard-interactive)

  • Allowed key types

  • Enabled algorithms

  • Hostkey fingerprint

Weak or outdated algorithms indicate potential misconfigurations.

Enumerating SSH Keys (Public Host Key)

ssh-keyscan 10.10.10.5

This reveals host keys that help detect:

  • Key reuse

  • Default keys

  • Weak key types (e.g., DSS)

SSH fingerprint patterns also provide OS identification clues.

Checking for Non-Standard Ports

nmap -sV -p- 10.10.10.5

SSH is often moved to ports like 2222 or 8022 for obscurity. Enumeration ensures these services are not missed.

RDP Enumeration

RDP uses port 3389 and provides GUI-based remote access. Enumeration focuses on version details, security settings, and authentication behavior. Misconfigured RDP services are major attack vectors.

Basic RDP Scan

nmap -sV -p3389 10.10.10.5

This identifies the RDP version and service details.

Checking RDP Security Settings

nmap --script rdp-enum-encryption -p3389 10.10.10.5

This reveals:

  • Supported encryption levels

  • Security mode (RDP, TLS, CredSSP)

  • Weak or deprecated settings

Weak encryption indicates risks such as downgrade attacks.

Checking for NLA (Network Level Authentication)

nmap --script rdp-ntlm-info -p3389 10.10.10.5

NLA protects RDP from certain attacks. If disabled, brute-force and credential spraying become easier.

Fingerprinting Windows Versions via RDP

nmap --script rdp-enum-features -p3389 10.10.10.5

This reveals features associated with specific Windows versions. OS identification helps guide privilege escalation strategies.

RDP Service Behavior

RDP services sometimes leak metadata through:

  • SSL certificates

  • Hostnames

  • Domain names

  • Internal DNS patterns

Pentesters extract these during TLS handshakes.

Identifying Misconfigurations

During enumeration, pentesters check for:

  • Anonymous FTP access

  • Writable FTP directories

  • Outdated FTP servers

  • Weak SSH algorithms

  • Old OpenSSH versions

  • Reused SSH host keys

  • RDP without NLA

  • Weak RDP encryption

  • Exposed administrative RDP services

These issues often lead to credential theft, lateral movement, or direct compromise.

Why FTP, SSH, and RDP Enumeration Matters

FTP, SSH, and RDP provide direct access to systems. Enumeration reveals authentication mechanisms, configuration weaknesses, software versions, and potential exploit paths. Proper analysis of these services helps pentesters plan brute-force attempts, detect outdated servers, and identify misconfigurations that expose internal systems.

Intel Dump

  • FTP enumeration checks banners, anonymous login, directories, and modes

  • SSH enumeration inspects banners, authentication methods, key types, and algorithms

  • RDP enumeration identifies encryption settings, NLA status, and Windows version clues

  • Misconfigurations in any of these services create direct attack paths

HOME LEARN COMMUNITY DASHBOARD