“FTP transmits data—including credentials—in plaintext, making it vulnerable to eavesdropping and attacks like brute force. Gaining initial access through an open FTP port remains a common and effective technique in modern enterprise penetration testing.”
FTP has no rate limiting, no lockout, and no session state worth speaking of — every attempt is a fresh USER/PASS exchange and the server answers 530 or 230 with no delay it was not configured to add. That is why it remains the friendliest brute-force target on an internal network, decades after everyone agreed to stop using it. Password Cracking: FTP is a multi-tool methodology for finding and breaking the ones that are still there.
Systematic Service Enumeration
The manual insists on reconnaissance before noise. nmap -p 21 -sV establishes not just that the port is open but which daemon and version is answering — which matters because ProFTPD, vsftpd and a Windows IIS FTP site fail differently under load, and because a banner that looks too inviting is sometimes a honeypot doing its job.
The enumeration phase is mapped to MITRE ATT&CK under T1046 (Network Service Discovery), which is useful shorthand when the finding has to appear in a report alongside a client’s detection coverage.
The Brute-Force Arsenal
The bulk of the text is a deployment reference, built on the observation that environments respond differently to load — a rate that an isolated internal server absorbs happily will trip a cloud WAF or an inline IPS instantly.
Syntax is given across the range:
- Hydra and Medusa: The parallelised standards. Both will comfortably exhaust the connection limits on a small FTP daemon at default thread counts, so
-t 4is the responsible starting point on anything live; the faster setting is how you take down the file server you were hired to test. - NetExec (nxc) and Metasploit: Worth using when you want the successful pair to flow straight into post-exploitation and into a database, rather than into your scrollback.
- Patator and Ncrack: Throttling and timing control, for when the objective is not to be noticed rather than to finish quickly.
- BruteSpray: Nmap XML piped directly into automated credential testing across a whole subnet. Extremely efficient, and the least discriminating thing in the list — it will hit systems you did not individually consider, which makes scope verification a prerequisite rather than a formality.
Who Is This Book REALLY For?
- Red team operators: Breadth is the practical value. When one framework fails protocol negotiation against an obscure legacy daemon — and it will — having the syntax for the next six to hand saves the afternoon.
- SOC analysts: Plaintext authentication means the attack is fully visible to Snort or Zeek, so the raw signatures here translate directly into alerts (T1110.001). The complication worth planning for is that legitimate automated FTP jobs also authenticate in bursts on a schedule, so a naive threshold rule fires nightly on the backup script and gets muted within a fortnight.
- Systems administrators: The case for IP restriction and for FTPS or SFTP. The trade-off is the reason the server is still running: migrating means finding every scheduled job, embedded credential and vendor appliance that speaks FTP and nothing else, and some of those have no owner left.
The Bottom Line
Password Cracking: FTP is a rebuttal to the idea that internal means trusted. The mechanics are trivial, which is the point — the interesting question is never how the attack works but why the service is still listening, and the answer is usually that nobody could establish what would break if it stopped.
