Listen to this Post
Introduction:
In April 2026, Censys released a startling report revealing that nearly 6 million FTP servers remain publicly accessible on the internet, with approximately 2.45 million of them showing no evidence of encryption (TLS/SSL). This means usernames, passwords, and sensitive files are still transmitted in cleartext—exactly as they were when the protocol was designed in the 1970s, making credential harvesting and data interception trivial for any attacker on the same network path.
Learning Objectives:
- Identify exposed FTP servers using reconnaissance tools like Nmap, Masscan, and Shodan.
- Detect whether an FTP server supports TLS/SSL encryption and enforce explicit FTPS.
- Harden Linux and Windows FTP server configurations to prevent anonymous access, enforce encryption, and mitigate brute-force attacks.
You Should Know:
- Scanning for Open FTP Ports (21/TCP) at Scale
The first step in understanding the scope of this issue is to perform authorized scanning. Below are commands to detect FTP servers on your own network or with explicit permission.
Linux (Nmap):
Scan a single host for FTP service nmap -p 21 --script=ftp-anon,ftp-bounce,ftp-proftpd-backdoor <target_IP> Scan a /24 subnet for open port 21 nmap -p 21 -sV --open 192.168.1.0/24 -oG ftp_scan.txt Masscan for high-speed Internet-wide scanning (use only on owned ranges) sudo masscan -p21 --rate=10000 --output-format json --output-file ftp_masscan.json <CIDR_range>
Windows (PowerShell with Test-NetConnection):
Test a single IP
Test-NetConnection -Port 21 -ComputerName 192.168.1.10
Scan a range using a loop
1..254 | ForEach-Object { Test-NetConnection -Port 21 -ComputerName "192.168.1.$_" -InformationLevel Quiet }
What this does:
These commands check if TCP port 21 is open and listening. The Nmap `-sV` flag grabs the FTP banner and version, while the `ftp-anon` script tests for anonymous login. Masscan is ideal for large-scale discovery but must be used responsibly.
2. Testing for Cleartext vs. TLS Encryption
Once an FTP server is discovered, verify whether it supports FTPS (FTP over TLS). Many misconfigured servers fail to enforce encryption even if TLS is available.
Using `lftp` (Linux):
Attempt explicit FTPS (port 21, STARTTLS) lftp -u username,password -e "set ftp:ssl-force true; set ftp:ssl-protect-data true; ls; quit" ftp://target_host Check if server advertises AUTH TLS openssl s_client -starttls ftp -connect target_host:21 -tlsextdebug
Using `curl` (Cross-platform):
Plain FTP (cleartext) curl -v --user username:password ftp://target_host/ Force FTPS (explicit) curl -v --ssl-reqd --user username:password ftps://target_host/
Windows (IIS FTP with PowerShell):
Download and list files using .NET WebRequest (cleartext by default)
$request = [System.Net.FtpWebRequest]::Create("ftp://target_host/file.txt")
$request.Credentials = New-Object System.Net.NetworkCredential("user","pass")
$request.Method = [System.Net.WebRequestMethods+Ftp]::DownloadFile
$response = $request.GetResponse()
Step-by-step guide:
- Install `lftp` (
sudo apt install lftpon Debian/Ubuntu). - Run the `lftp` command with
ssl-force true; if the server does not support TLS, the connection will fail. - If the connection succeeds but the server also accepts plain FTP, your credentials are still vulnerable unless you force encryption.
- Use `openssl s_client` to manually verify the server’s advertised TLS capabilities.
3. Exploiting Anonymous & Weak FTP Credentials
Attackers often target FTP servers with anonymous login enabled or default credentials (admin:admin, ftp:ftp). This section demonstrates how to test for these weaknesses.
Anonymous login test (Nmap script):
nmap -p 21 --script=ftp-anon <target_IP>
Hydra brute-force attack (authorized testing only):
Brute-force FTP passwords using a wordlist hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://target_IP Combined user and password list hydra -L users.txt -P passwords.txt ftp://target_IP -s 21 -t 4
Manual anonymous access:
ftp target_IP Enter username: anonymous Password: anything or [email protected] ls -la get sensitive_config.txt
What this demonstrates:
Misconfigured servers allow unauthorized file retrieval or upload. In a real attack, this could lead to defacement, malware hosting, or lateral movement.
4. Hardening Linux FTP Servers (vsftpd + TLS)
To mitigate exposure, system administrators must disable anonymous access, enforce TLS, and restrict user directories.
Install vsftpd with SSL support:
sudo apt update && sudo apt install vsftpd openssl -y
Generate a self-signed certificate:
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \ -keyout /etc/ssl/private/vsftpd.key \ -out /etc/ssl/certs/vsftpd.crt
Edit `/etc/vsftpd.conf` with these hardening directives:
Disable anonymous login anonymous_enable=NO local_enable=YES Force TLS encryption ssl_enable=YES allow_anon_ssl=NO force_local_data_ssl=YES force_local_logins_ssl=YES ssl_tlsv1=YES ssl_sslv2=NO ssl_sslv3=NO Certificate paths rsa_cert_file=/etc/ssl/certs/vsftpd.crt rsa_private_key_file=/etc/ssl/private/vsftpd.key Additional security chroot_local_user=YES allow_writeable_chroot=YES hide_ids=YES max_clients=50 max_per_ip=5
Restart and verify:
sudo systemctl restart vsftpd sudo systemctl enable vsftpd sudo netstat -tulnp | grep :21
Step-by-step hardening:
- Never use plain FTP on a public network; switch to SFTP (SSH) or FTPS.
- If FTPS is required, enforce `force_local_logins_ssl=YES` to reject any non‑TLS connection.
- Set `chroot_local_user=YES` to jail users into their home directories.
- Regularly audit logs at `/var/log/vsftpd.log` for brute‑force attempts.
5. Securing Windows FTP (IIS FTP Server)
Windows Server with IIS FTP often defaults to cleartext. Here’s how to enable FTP over TLS.
Install FTP Server role (PowerShell as Admin):
Install-WindowsFeature -Name Web-FTP-Server -IncludeAllSubFeature
Create an SSL certificate for FTP:
Self-signed cert for testing $cert = New-SelfSignedCertificate -DnsName "ftp.yourdomain.com" -CertStoreLocation "cert:\LocalMachine\My"
Configure FTPS in IIS Manager:
- Open IIS Manager → Sites → Add FTP Site.
- Under “SSL”, select Require SSL and choose the certificate.
- Under “Authentication”, disable Anonymous and enable Basic (but only over SSL).
4. Set `ftp.ssl.require.encrypted.data` to `true` via command line:
Set-WebConfigurationProperty -Filter "system.ftpServer/security/ssl" -Name "controlChannelPolicy" -Value "SslRequire" Set-WebConfigurationProperty -Filter "system.ftpServer/security/ssl" -Name "dataChannelPolicy" -Value "SslRequire"
Test with WinSCP or FileZilla – ensure that “Explicit FTP over TLS” is used and that plain FTP connections are rejected.
6. Monitoring and Detecting Cleartext FTP Traffic
Security teams can detect cleartext FTP on the network using Zeek (formerly Bro) or tcpdump.
Capture FTP credentials with tcpdump:
sudo tcpdump -i eth0 -A -s 1500 'tcp port 21 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x50415353)' "PASS"
Zeek script to log cleartext FTP commands (local.zeek):
event ftp_request(c: connection, command: string, arg: string)
{
if (command == "PASS")
print fmt("Cleartext password detected from %s: %s", c$id$orig_h, arg);
}
Snort/Suricata rule:
alert tcp $HOME_NET any -> any 21 (msg:"Cleartext FTP Password"; content:"PASS"; nocase; sid:1000001; rev:1;)
What this accomplishes:
Network monitoring can immediately flag any FTP session transmitting passwords in the clear, allowing incident response to block or quarantine the endpoint.
7. Migrating from FTP to Modern Alternatives
The permanent fix is to decommission plain FTP entirely. Recommended replacements:
- SFTP (SSH File Transfer Protocol) – Encrypted by default, uses port 22.
- FTPS (FTP over TLS) – Acceptable if properly enforced.
- WebDAV over HTTPS – For cloud‑integrated storage.
- Rsync over SSH – For automated scripts.
Example SFTP server setup (Linux):
OpenSSH already provides SFTP. Just restrict users. sudo nano /etc/ssh/sshd_config Add: Subsystem sftp internal-sftp Match Group sftponly ChrootDirectory /home/%u ForceCommand internal-sftp PasswordAuthentication yes PermitTTY no sudo systemctl restart sshd
Windows SFTP with OpenSSH:
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 Set-Service -Name sshd -StartupType 'Automatic' Start-Service sshd Then configure chroot in C:\ProgramData\ssh\sshd_config
What Undercode Say:
- Key Takeaway 1: Basic operational hygiene—disabling legacy cleartext protocols—remains more critical than chasing zero‑days. Nearly 2.5 million servers failed even minimal TLS adoption.
- Key Takeaway 2: Attackers don’t need advanced exploits; they simply scan for port 21, harvest credentials via packet capture or brute force, and then pivot internally. The Censys data is a wake‑up call for asset management.
The persistence of cleartext FTP in 2026 reflects systemic issues: shadow IT, forgotten legacy systems, and lack of encryption‑by‑default policies. While the industry obsesses over AI‑driven detection, adversaries are automating FTP scrapers. Red teams should prioritize this vector in internal penetration tests, and blue teams must deploy network monitoring for `PASS` commands. Cloud providers (AWS, Azure, GCP) often block port 21 by default, but on‑premises and hybrid environments remain vulnerable. The fix is cheap and well‑documented—yet millions ignore it. This is not a sophistication gap; it is a discipline gap.
Prediction:
Within 12 months, we will see a major data breach attributed directly to cleartext FTP exposure, likely involving a healthcare or manufacturing OT environment where legacy FTP controllers cannot be updated. Regulatory bodies (GDPR, HIPAA, PCI‑DSS) will begin issuing explicit fines for detectable cleartext FTP services, and cyber insurance underwriters will mandate quarterly port‑21 scans. By 2027, major cloud marketplaces will automatically flag and alert on any public FTP endpoint without TLS, potentially blocking inbound cleartext connections by default. Organizations that fail to migrate to SFTP or enforce FTPS will become low‑hanging fruit for ransomware gangs using credential stuffing from previously leaked FTP dumps.
▶️ Related Video (76% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Andrehackersec Ciberseguranca – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
