What does FTP do?
FTP (File Transfer Protocol) lets a computer upload files to a server and download files from it.
Think of a document pickup desk. First check that the desk is open, then identify yourself, look at the catalog, and ask for a particular document. Each step has its own conditions.
FTP enumeration means collecting service replies, login options, and the directory and file information visible to a particular identity. An FTP client translates your actions into protocol commands.
Why can login work while a directory listing stalls?
FTP commonly uses two kinds of connections: • Control connection: carries login information, commands, and replies. The server commonly listens on TCP port 21. • Data connection: carries directory listings or file contents over a separate connection.
There are two common ways to establish the data connection: • Active mode: the client supplies a listening endpoint, and the server initiates the data connection. • Passive mode: the server supplies a listening endpoint, and the client initiates the data connection.
If login succeeds but a listing stalls, check the data connection, firewall, and mode settings, then check permissions. TCP port 20 is the traditional server data port in active mode; it is not used for every FTP transfer. Passive mode uses a separately negotiated port. EPSV is the extended passive-mode command. FTP specification · Extended modes
These are connection roles, not permission levels.
- Control connection
Client → server, commonly TCP 21; exchanges commands and replies.
- Data connection
Carries listings or files; the server initiates active mode, the client initiates passive mode.
What does anonymous login tell you?
Anonymous FTP commonly uses an identity such as anonymous to provide access to material the administrator has designated as public.
If the server accepts anonymous login, you have confirmed that this login was allowed. Check these actions separately: • Which directory can this identity list? • Which file can it download? • Can it upload, overwrite, or delete files?
Public downloads may be an intended feature. Compare access with the intended policy: are internal files exposed, or is writing allowed by mistake? FTP security considerations
Connect the ideas with a made-up example
This is a synthetic authorized-lab scenario, not a query we ran. The target, test identity, actions, and files have all been agreed on in the scenario: • Connect to FTP: receive a 220 greeting. • Sign in with the test identity: receive 230, indicating successful login. • List the specified directory: see readme.txt and report.txt. • Download readme.txt: transfer completes and the expected synthetic test content is received. • Download report.txt: receive 550. • Upload or delete: not tested.
The names in the listing are the enumeration result here. FTP uses LIST for a listing, RETR for retrieval, and STOR for upload. The commands shown by your client may have different names.
A useful record would say: “The test identity logged in and listed two filenames. The readme.txt download completed; the request to download report.txt received 550. Upload and delete permissions await separate checks.”
550 means the requested file action was not taken; the file may be absent or access conditions may prevent the action. Use the full reply, exact path, and server logs to determine why. 425 indicates that the data connection could not be opened. Treat product and version text in a greeting as a clue and compare it with administrative records. Commands and reply codes
Uses the synthetic example above. Untested actions remain open.
- List directory
Names readme.txt and report.txt are visible.
- Download readme.txt
Transfer completes and test content is checked.
- Download report.txt
550 received; use the path, reply, and logs to establish the cause.
- Upload / delete
Not tested here; verify within separately agreed boundaries.
How do you protect the service and record evidence?
Start with the intended use. Allow only the identities and directories needed, separate read and write permissions, limit unnecessary anonymous access, and monitor login failures, file actions, and unusual transfers.
Traditional FTP can send credentials and data in cleartext. Options for protecting transfers include: • FTPS: FTP with TLS. Check protection for both the control connection and the data connection. • SFTP: file transfer over SSH, using a different protocol.
Encrypted transport still leaves file permissions to the server’s access policy. FTP over TLS · OpenSSH SFTP
Record the time, target, identity, connection mode, exact path, action, and full reply. Practice in an authorized environment with synthetic files. Keep passwords in appropriate protected storage and de-identify any evidence you publish.
One small check
You successfully log in to FTP and see report.txt in a listing, but its download returns 550. In two or three sentences, what have you confirmed? What evidence would help explain the failed download and determine upload permissions?
This teaching check awaits your answer. The page does not submit answers or update understanding. The next core concept is M04-04 SMB enumeration.
Concept Q&A
Pending: related questions will be edited into anonymous teaching notes when available.