skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pentesting-tftp

Tests TFTP services on UDP port 69 for unauthenticated file read and write access.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#firmware#Nmap#network services#tftp#config extraction#udp 69
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill pentesting-tftp
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentesting-tftp
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-services-pentesting/pentesting-tftp
Command: npx skills add https://github.com/xalgord/xalgorix --skill pentesting-tftp

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires tftpy.

What problem does it solve?

TFTP servers have no authentication and no directory listing, so testers often miss exposed device configs, firmware images, and writable roots. This Skill provides a structured workflow to enumerate, access, and document TFTP exposures during authorized engagements.

Core Features & Use Cases

  • Enumeration: Uses nmap's tftp-enum script and custom file lists to brute-force default and device-specific file paths over UDP/69.
  • Read/Write Testing: Guides manual tftp client, Metasploit tftp_transfer_util, and Python tftpy checks to confirm unauthenticated get/put access.
  • Config & Firmware Extraction: Targets known filenames like running-config, SEP<MAC>.cnf.xml, and pxelinux.cfg/default to recover credentials, SNMP strings, and topology data.
  • Use Case: During an internal network assessment, you find UDP/69 open on a switch; this Skill walks you through pulling the running-config, decoding Type-7 passwords, and documenting the writable root as a high-impact finding.

Quick Start

Run nmap with the tftp-enum script against the target on UDP port 69, then use a tftp client to get and put files to confirm unauthenticated access.

Frequently Asked Questions about pentesting-tftp

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate files on a TFTP server?▼

TFTP has no directory listing, so file names must be brute-forced. Run nmap -sU -p69 --script tftp-enum against the target, optionally passing a custom file list with --script-args tftp-enum.filelist=yourlist.txt.

How do I test TFTP read and write access without credentials?▼

TFTP has no authentication, so any reachable client can attempt transfers. Use the tftp client to run get and put commands, or use Metasploit's auxiliary/admin/tftp/tftp_transfer_util module for scripted download and upload tests.

What files should I look for on a TFTP server?▼

Target device provisioning files such as running-config, startup-config, SEP<MAC>.cnf.xml for Cisco VoIP phones, pxelinux.cfg/default, and ROM or firmware images. These often contain cleartext or Type-7 passwords, SNMP community strings, and network topology details.

Why does my TFTP transfer fail or return garbage?▼

Binary files like firmware images corrupt when transferred in netascii mode. Switch to octet (binary) mode before running get or put, and verify the server is reachable over UDP since many scanners mislabel port 69.

Can I use Python to automate TFTP downloads and uploads?▼

Yes, the tftpy library supports scripted transfers. Create a TftpClient with the target IP and port 69, then call download() or upload() with the remote filename, local path, and a timeout value.

Related Skills

Explore More Software Engineering Skills→
BrownFineSecurityBrownFineSecurity
811

nmap

Identify open ports and enumerate network services with Nmap.

Official
Advanced
AeonDaveAeonDave
15

cain-and-abel

Recovers Windows passwords by sniffing network traffic and cracking hash types.

Community
Intermediate
blacklanternsecurityblacklanternsecurity
253

infrastructure-enumeration

Enumerate DNS, SMTP, SNMP, and HTTP services on target hosts.

Official
Intermediate
theslashdojotheslashdojo

copy

Transfer files and directories over SSH using scp or sftp.

Official
Intermediate