File Transfer Protocol. A simple client server protocol for transfering a file over a network. Most operating system come with the client application. FTP provides no confidentiality or integrity to the data being trasfered.

learn more… | top users | synonyms

1
vote
1answer
33 views

FireFTP security [closed]

I've just installed the FireFTP plugin for Firefox, I have been using Adobe Dreamweaver's FTP up to now but wanted to try something different. When I opened it up and saw all of my computer's files ...
13
votes
3answers
2k views

FTP hacked, planted file [closed]

Can anyone help me to understand what this does? Someone has planted a file with this piece of code on my server.It is shortened because it cannot fit the question, but just to have some idea what ...
1
vote
2answers
72 views

What negotiates SSL ciphers? [duplicate]

In light of the recent FREAK vulnerability I am trying to get a hold on what ciphers are being used by inbound connections. I have FTP tracing on which is giving me which ciphers are being negotiated ...
4
votes
1answer
80 views

Android app using FTP

I have done some android programming (self taught). I have started working on an app idea. The idea is pretty much that people with the app installed can post pictures/videos and text which can be ...
3
votes
2answers
282 views

How to secure a network (FTP connections) from sniffers

I'm actually working in a medium sized company with security concerns. Let me explain you my problem : The context: My office has one single internet line. This line is accessed by anyone in the ...
3
votes
2answers
109 views

Does FTP provide any type of integrity?

To verify, that the files I have downloaded using it are not corrupted.
1
vote
1answer
162 views

FTP over SSL vs HTTPS implemention

Consider two implementations of SSL on a HTTP server and on an FTP server. With the same cipher suites used and the exact same protocols used. Is one more secure than the other. I have heard that it ...
0
votes
1answer
68 views

What to do against continuous FTP attack

I have a server (windows 2008) and this server uses WebsitePanel to host some websites. I tried to setup Mozilla FTP server, but I cannot get this to work. As I do not use it I do not mind. However ...
0
votes
1answer
1k views

SFTP or FTP through VPN?

I'm struggling to find out whether or not I should set up SFTP since I already connect to the internet using a secure VPN. Is the security using FTP through a VPN (using OpenVPN, more specifically ...
0
votes
2answers
462 views

Encrypt files on FTP server

I have a practical situation here, my company is a FTP server provider for some clients. The clients are sharing their files on our FTP server and have had no problem with access management and ...
2
votes
2answers
117 views

Who can actually see the password when I accidentally used ftp instead of sftp?

It has been said that if we accidentally use ftp instead of sftp, people can actually see the login name and password in pure text form, and it is very bad. But who can actually see it? Will it be ...
0
votes
1answer
52 views

Period and direction of risk when connecting to malicious webserver

Please forgive my terminology mishaps. Recently, I tried to connect to a server over SFTP. The SSH public key response differed by 1 byte to what I was expecting, from an info page. I was tempted to ...
1
vote
4answers
303 views

Protecting Password in Code

I am writing a program in Processing (which is basically java), that (amongst other things) downloads files from a FTP Server. To connect to the Server the program needs the correct FTP-password, ...
30
votes
8answers
13k views

Is it safe to store passwords on Google drive?

In the past I have seen having a Google drive document and have FTP username/passwords there. Is storing passwords in Google drive a good practice?
1
vote
2answers
2k views

How can I make a read-only filesystem read/write?

I recently hacked into my router which runs BusyBox v1.9.1. I want to edit some files in my web GUI interface which will allow me to get hidden options in it. I'm trying to edit a .js file and replace ...
0
votes
1answer
439 views

SElinux security context public_content_t for vsftpd

My understanding of SElinux context public_content_t is as public_content_t is required for files shared via a FTP server unless associated with a user home directory Here is my question Does user ...
2
votes
1answer
115 views

vsftpd metasploit evidence in logs?

We have a public ftp server that is being probed by the usual Chinese brute-force scans. They are probing vsftpd. Notmally a failed login to vsftpd looks like this in syslog: Mar 17 15:56:07 ...
0
votes
1answer
232 views

Access an ftp server gives me the passwd file though no shadow

I have gain access to a server via ftp which is showing me the passwd file with 2 users via ftp://1.2.3.4/../etc/passwd output is: root:*:0:0:root:: ftp:*:109:117:Anonymous FTP:: As such the ...
0
votes
4answers
202 views

How to secure my website's FTP?

When I opened ftp command prompt and typed open mydomain.com, it gave me the following and I think that this is a security vulnerable. connected to mydomain.com. 220----- Welcome to Pure-FTPd ...
0
votes
1answer
905 views

How to use an OR condition with the content of a snort rule

I understand that if you specify multiple contents then the rule triggers only if ALL the content conditions are satisfied. But I want to create a rule that will trigger even if any one of the ...
1
vote
1answer
272 views

Should I tunnel multiple TCP connections through a TLS/SSL tunnel or use TLS/SSL for each connection?

I am developing an application that runs on Windows PCs. The application is able to connect to some kind of devices within a LAN. It can create multiple TCP-connections to the device it is connected ...
1
vote
2answers
255 views

Securing multiple connections with different protocols all together

I need to secure the communication between an application (runs on any PC and has been designed for Windows) and an external device (runs on UNIX). The application is running on Windows while the ...
0
votes
1answer
147 views

vsftp encryption algorithm

I want to configure VSFTP for ftps protocol and it has some choices to select the encryption type: tlsv1, sslv2, sslv3. I read that tls version 1 has some security issues but in the man page it says ...
0
votes
1answer
255 views

Website Link Spam Hacking Protection [closed]

I've recently been employed as a junior web and software developer for a small company, and noticed that their Home page has had links to completely unrelated sites added like spam to the index.html ...
2
votes
3answers
162 views

A scammer placed a remote file on a Wordpress website?

A previous developer I have used has got upset and start compromising the files of my website on daily bases (such as changing the index of the site with weird messages, deleting the .htaccess, ...
6
votes
1answer
237 views

SFTP or FTPS for connecting to a VPS?

I'm going to be hosting one of my websites on a VPS soon and I want to make it as secure as possible. Only I will need access to the VPS, and I can't see that changing in the near future. Because it ...
20
votes
6answers
11k views

Should I use FileZilla?

Recently, an increasing number of people have started advising moving away from FileZilla. However, the only reason I can see for this is that FileZilla stores the connection information in a ...
0
votes
1answer
250 views

Allow read-only access to server-side pages for security review?

This answer: http://security.stackexchange.com/a/37319/10574 Mentions the issue of host-based security. To the end user, the web server is an untrustable black box. Would it provide to needed ...
3
votes
1answer
387 views

What is the danger of the “FTP RNFR ././ attempt”?

I am analysing an old attack and I got a scenario which does not really make sense to me. The attacker connects to the ftp service and runs a bunch "FTP RNFR ././ attempt". This is caught by snort as ...
2
votes
1answer
1k views

How safe is FireFTP?

After a bad experience with FTP credentials hacking I decided to start using SFTP and stop having FTP credentials stored in clear on my computer (Filezilla). I now use FireFTP which encrypts ...
0
votes
2answers
866 views

Keyloggers - Ports used by keyloggers

According to this article, keyloggers usually make use of the FTP ports and email ports: http://rbmikrotik.blogspot.com/2011/07/how-to-block-port-frequently-keylogger.html My question is, can a ...
1
vote
1answer
750 views

Script injection on different hosting servers = FTP hacking?

I've been seeing the exact same injected script on several of my websites for the last few weeks. Today I realize these websites don't share the same hosting servers, yet the attacks (1) started at ...
-2
votes
3answers
2k views

How does Google get information about FTP servers - and how to avoid it?

I searched the internet like this inurl:ftp -inurl:(http|https). I found many FTP hosts. I can add or remove files from some hosts. How does Google get information about FTP servers? How can one avoid ...
5
votes
1answer
981 views

How to fuzz on FreeFloat FTP server using SPIKE Fuzzing?

I would to seek help on using SPIKE fuzzer to fuzz an FTP server which I am testing on Freefloat FTP server but do not have idea on how to work on. As I research and tested out many different types of ...
12
votes
2answers
9k views

Can https be used instead of sftp for secure file transfers?

My company works with financials, and we are required to transfer files containing non-public consumer information securely between our company and our clients. The usual solution is to go with sftp ...
7
votes
3answers
20k views

Good Practices to secure FTP access

We have several web applications (B2B, B2C eCommerce). Where developers have access to upload files. I need to ensure FTP part is Secure enough. What practices / steps should I follow? Now I do, ...
1
vote
1answer
2k views

Nmap port scan and FTP bounce

Suppose that there is a network of machines, and there is a server with ftp server that allows ftp bounce. I do a nmap scan on the network nmap -sC -some other parameters network address. Does nmap ...
2
votes
0answers
1k views

Hack scenario when a person has a non-superuser shell [closed]

Suppose that there are following three machines in the network: Machine A: Microsoft Server 2003 Service Pack 2 FileZilla 0.9.29 beta ftp server (TCP 21) Mcafee ePolicy server (81), remote desktop ...
3
votes
1answer
319 views

How to forward an specific FTP User to a Honeypot?

What I'm trying to do is to forward a specific FTP-User to a Honeypot, because the main server is for Shared Hosting and there's a lot of traffic, and I don't want to spend all the resources in ...
4
votes
2answers
900 views

Should your client SSL Trusted Authority contain only root and intermediate certificates?

I'm getting conflicting information and it seems people are using certificates a little differently depending on how much effort they want to expend in managing them, and maybe the application being ...
1
vote
1answer
2k views

Is the ftp server insecure, or someone is sniffing our ftp passwords?

Some of the sites that I work with was compromised a while ago, I requested the FTP logs from the hosting company and they provided me with this: ftp.somesite.com 64.29.xxx.xxx ...
2
votes
2answers
13k views

known public exploits for vsftpd 2.0.1/2.0.5

I somehow noticed that there were numerous reports of security vulnerabilities of vsftpd 2.0.1~2.0.5; however, there just seems to be no public exploits. The server I am working on has vsftpd 2.0.5 ...
3
votes
2answers
202 views

Ftp constantly asked for a .exe file, what can i do?

I rent a web server ("service") at a web hosting site which recently i assume got hacked but i am unsure how... I know it got hacked because recently out of the blue certain files and folder appeared ...
0
votes
1answer
497 views

website hacked and all its content erased despite the protections

i was hacked by a guy who erased everything. I spent the day to put everything in order, and i would like to find a solution for this : he erased all the files, and also changed the title for "www" in ...
11
votes
5answers
3k views

Is it worth the effort to store FTP passwords encrypted?

I have a project to build a system that needs to push files to multiple third-party FTP servers. I have asked these third parties to provide a more secure interface; all have declined. So now I have ...
4
votes
1answer
152 views

Sulley - only using ASCII printable characters

I have a problem fuzzing FTP protocol. An example of a command fuzzed is the following data model, which should fuzz the "CWD [string]" command of the FTP protocol. s_initialize('CWD') ...
7
votes
1answer
503 views

Sulley - optional element and command check

I'm currently using Sulley to fuzz my FTP server, but I'm having problems. I want to specify the STRU command, which has a syntax: STRU [<SP> F|R|P] <CRLF> I tried to specify the ...
1
vote
2answers
3k views

Anonymous FTP Risks

If my IIS 6.0 web server is disabled and the only other service running is FTP, what are the security risks of allowing anonymous FTP read/write, considering that a random person couldn't use any sort ...
1
vote
2answers
3k views

how to protect my ftp from being hacked?

my ftp was hacked, a file has been uploaded and the host suspended the website temporarily. I'm only using an admin page that points to an xml file (to load and modify the text of my website), i don't ...
9
votes
4answers
445 views

If I try to log into the wrong host with FTP do they now have my credentials?

Say I make a typo in the host name. Are my credentials now somewhere in the wrong hosts server log? Should I go about changing my credentials just in case now?