FTP Bounce attack - Scan
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Connect to vulnerable FTP
Use **PORT**or EPRT(but only 1 of them) to make it establish a connection with the <IP:Port> you want to scan:
PORT 172,32,80,80,0,8080
EPRT |2|172.32.80.80|8080|
Use LIST(this will just send to the connected <IP:Port> the list of current files in the FTP folder) and check for the possible responses: 150 File status okay (This means the port is open) or 425 No connection established (This means the port is closed)
Instead of LIST you could also use RETR /file/in/ftp and look for similar Open/Close responses.
Example Using PORT (port 8080 of 172.32.80.80 is open and port 7777 is closed):
Same example using EPRT(authentication omitted in the image):
Open port using EPRT instead of LIST (different env)
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
