I am currently doing a project on FTP bounce and after reading up, I still do not really get how it works/can work. Appreciate if I can receive enlightenment from the experts here.

I understand that the FTP bounce vulnerability allows an attacker to send commands to an FTP server through another intermediate server that they have access to.

However, what I do not understand is:

  1. Using the nmap commands on https://book.hacktricks.xyz/network-services-pentesting/pentesting-ftp/ftp-bounce-attack, what do I seek to observe (eg. services running on loopback on the intermediate server? services running on the victim server?)

1a. Expanding on the question above, what if I do not have the ip address of the victim server, what use is the FTP bounce then?

  1. Can you use the FTP bounce vulnerability to transfer files or execute commands on the victim server or intermediate server?

Sorry if the questions are stupid. I may be lacking in my foundational knowledge of FTP bounce and am not getting the information I need via the internet. My eventual goal is to know the attack vectors (directory traversal, remote command execution etc) that are made available to attackers who discover the FTP bounce vulnerability.

Any references to material are very very welcome!

1 Answer 1

  1. You're scanning for open ports (nmap docs). They may have services associated with them, and nmap may suggest the services that typically run on that port or assume which are actually running based on the responses received.
  1. No. You need to know the IP to send a request (unless you're on the LAN)
  1. Yes. Procedure for doing so (both execution and uploading files) is here
  • 1. I am able to use nmap to scan the machine to determine if there are any services that are running only on loopback, and also scan any internal hosts that this machine shares the subnet with? Commented May 6, 2022 at 13:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .