📚
Notes
  • Welcome
    • Intro
    • My OSCP Exam Adventure
  • Security Blogs
    • Initial Access 101
      • Spring Cloud Function CVE-2022-22963
    • Bug Hunting
      • XSS
        • Blog site search field
  • Active Directory
    • Tools
    • Common built-in AD groups
    • Identifying Users
    • LLMNR/NBT-NS Poisoning
    • Password Spraying
      • Enumerating & Retrieving Password Policies
      • Making a Target User list
      • Internal Password Spraying - from Linux
      • Internal Password Spraying - from Windows
    • Credentialed Enumeration
      • Linux
      • Windows
      • Living Off the Land
    • Kerberoasting
      • Linux
      • Windows
    • ACL
      • Enumeration
      • Abusing ACLs
      • DCSync
    • Privileged Access
    • AS-REP Roasting
    • Attacking Trusts
      • Enumerating Trust Relationships
      • Child -> Parent Trusts
      • Cross-Forest Trust Abuse
  • Enumeration
    • SMB, RPC - 137,138,139,445,111
    • MYSQL - 3306
    • MSSQl - 1433
    • FTP - 21
    • RPC - 111
    • DNS - 53
    • NFS - 2049
    • SMTP - 25
    • IMAP, POP3 - 110,143,993,995
    • SNMP - 161
    • SVN - 3690
    • IRC - 8067
    • Oracle TNS - 1521
    • LDAP
    • Linux Remote Management Protocols
    • Windows Remote Management Protocols
    • Fuzzing
    • IPMI - 623(UDP)
  • Common Applications
    • Application Enumeration
    • CMS (Content Management System)
      • Wordpress
      • Joomla
      • Drupal
    • Servlet Containers/Software Development
      • Tomcat
      • Jenkins
    • Customer Service Mgmt & Configuration Management
      • Gitlab
  • Shells
    • Reverse Shells
    • Bind Shells
    • Spawning a TTY Shell
    • Web Shells
  • Privilege Escalation
    • Other Resources
    • Linux PrivEsc
    • Windows PrivEsc
      • Windows Users Privileges
      • Information Gatthering & Enumeration
      • Privilege Escalation Techniques
  • File Transfers
    • Quick Cheatsheet
    • Windows File Transfer
    • Linux File Transfer
  • Password Attacks
    • Linux Local Password Attacks
      • Credential Hunting in Linux
      • Passwd, Shadow & Opasswd
    • Windows Local Password Attacks
      • Attacking SAM
      • Attacking LSASS
      • Attacking Active Directory & NTDS.dit
      • Credential Hunting in Windows
    • Pass-the-Hash (PtH)
    • Cracking Files
    • Remote Password Attacks
  • SIde Notes
    • Pivoting, Tunneling, and Port Forwarding
    • File Encryption
  • Programming
    • Downloading Files
Powered by GitBook
On this page
  • Service Interaction
  • Nmap FTP Scripts
  • Brute Forcing
  1. Enumeration

FTP - 21

PreviousMSSQl - 1433NextRPC - 111

Last updated 2 years ago

  • FTP commands -

Service Interaction

# Anonymous Login
ftp ip

# vsFTPd status
status

# vsFTPd Detailed Output
debug 
trace

# Recursive Listing
ls -R

# Download a file
get filename

# Download All Available Files
wget -m --no-passive <ftp://anonymous:anonymous@10.10.10.10>

# Upload a file
put filename

# Netcat 
 nc -nv ip 21

# telnet
telnet ip 21

# Using OpenSSl for TLS/SSL encryption
openssl s_client -connect 10.129.14.136:21 -starttls ftp

Nmap FTP Scripts

# updating database of NSE scripts
sudo nmap --script-updatedb

# find the available ftp nmap scripts in system
find / -type f -name ftp* 2>/dev/null | grep scripts 

# Nmap scan for FTP on port 21
nmap -sV -p21 -sC -A ip

# to trace the progress of NSE scripts
nmap -sV -p21 -sC -A ip --script-trace

Brute Forcing

# Medusa 
# LINK : <https://github.com/jmk-foofus/medusa>

# Brute forcing using medusa
medusa -u fiona -P /usr/share/wordlists/rockyou.txt -h ip -M ftp
https://www.smartfile.com/blog/the-ultimate-ftp-commands-list/