skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pentesting-ftp

Tests FTP services for anonymous access, weak credentials, bounce attacks, and writable webroot uploads.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#network security#brute force#Nmap#FTP#anonymous login#ftp bounce
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill pentesting-ftp
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentesting-ftp
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-services-pentesting/pentesting-ftp
Command: npx skills add https://github.com/xalgord/xalgorix --skill pentesting-ftp

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

FTP services are frequently misconfigured with anonymous logins, default credentials, and writable directories mapped to web roots, yet these issues are often missed during authorized penetration tests. This Skill provides a structured methodology to enumerate, authenticate against, and exploit FTP services so testers can prove real impact instead of reporting guesses.

Core Features & Use Cases

  • Enumeration and Fingerprinting: Banner grabbing, nmap NSE scripts (ftp-anon, ftp-bounce), and protocol commands (HELP, FEAT, STAT, SYST) to identify server versions and capabilities.
  • Authentication Testing: Anonymous login checks, default credential lists from SecLists, and brute forcing with hydra, medusa, or netexec.
  • Exploitation Workflows: FTP bounce port scanning, protocol relay via PORT/RETR, writable webroot webshell uploads, and triage of known CVEs like vsFTPd 2.3.4 backdoor and ProFTPD mod_copy.
  • Use Case: During an authorized engagement, a tester finds ProFTPD on port 21 with default XAMPP credentials, uploads a PHP shell into the htdocs webroot, and confirms remote code execution as the web server user.

Quick Start

Use the pentesting-ftp skill to enumerate and test the FTP service on the authorized target at 10.10.10.5 for anonymous access and weak credentials.

Frequently Asked Questions about pentesting-ftp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test FTP for anonymous login access?▼

Test FTP anonymous login by running nmap --script ftp-anon -p21 against the target, or connect with the ftp client using anonymous as both username and password. Confirm access by listing all files with ls -a, including hidden ones.

How to brute force FTP credentials with hydra?▼

Brute force FTP credentials using hydra -t 1 -l <username> -P ftp-betterdefaultpasslist.txt -vV <IP> ftp with the SecLists default password list. Medusa and netexec (nxc ftp) are alternatives for credential spraying against the service.

What is an FTP bounce attack and how do I test it?▼

An FTP bounce attack abuses the PORT/EPRT commands to make the server connect to arbitrary hosts and ports, enabling internal port scanning. Test it with nmap -b anonymous:anonymous@<IP> -p- <target> or the ftp-bounce NSE script.

Can FTP anonymous upload lead to remote code execution?▼

Yes, when the FTP root maps to a script-executable webroot such as XAMPP's /opt/lampp/htdocs, uploading a PHP shell via put shell.php and requesting it over HTTP yields code execution as the web server user.

Which dangerous vsFTPd configuration settings should I check?▼

Check /etc/vsftpd.conf for anonymous_enable, anon_upload_enable, anon_mkdir_write_enable, write_enable, and no_anon_password. These settings permit unauthenticated uploads and directory creation, turning anonymous access into a writable file drop.

Related Skills

Explore More Software Engineering Skills→
EntroVyxEntroVyx
3

port-service-discovery

Identify open network ports and service versions with nmap.

Community
Intermediate
Prohao42Prohao42
120

windows-lateral-movement

Execute lateral movement techniques on Windows systems for penetration testing.

Community
Advanced
AeonDaveAeonDave
15

hydra

Perform online brute-force and password spraying attacks against over 50 network protocols.

Community
Intermediate
wgpsecwgpsec
1.7k

ftp-pentesting

Tests FTP services on port 21 for anonymous access, weak credentials, and known exploits.

Official
Advanced