File transfer protocol (FTP) is a standard network protocol used to transfer files between computers. Listening on TCP/21.
Usually FTP server attacks involve configurations or excessive privileges, and exploiting vulnerabilities.
Anonymous authetication can be configured for FTP, to access with anonymous login we can use the anonymous username and no password.
Brute Force
Brute-force login for the FTP service can also be executed.
# brute force attack
## -U can specify username list instead of single user
medusa -u fiona -P /usr/share/wordlists/rockyou.txt -h 10.129.203.7 -M ftp Bounce Attack
FTP bounce attack is a network attack that uses FTP servers to deliver outbound traffic to another device on the network. The attacker uses a port command to trick the FTP connection into running commands and getting information from a device other than the intended server. Essentially using the server as a proxy.
# FTP bounce attack
nmap -Pn -v -n -p80 -b anonymous:password@10.10.110.213 172.17.0.2