Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ftp]

File Transfer Protocol. A simple client server protocol for transfering a file over a network. Most operating system come with the client application. FTP provides no confidentiality or integrity to the data being trasfered.

1
vote
1answer
28 views

Exfiltration through FTP using XXE on a Tomcat server

I'm trying to extract binary data from a Tomcat server that is using SAXParser. For my FTP server, I am using this source. I'm hosting two DTD's on Github Gist. These are their contents: Base XML (...
1
vote
1answer
47 views

How can I verify the certificates when connecting to an FTP server with Filezilla?

Today most hosting providers start a TLS connection whenever you connect to their FTP server. But Filezilla doesn't store any root certificates, so whenever you connect to an FTP server and the TLS ...
0
votes
1answer
74 views

Differ between encrypted and unecrypted FTP (21) without login

I'm looking at an IP range as a part of a project and discovered several FTP server. They all run vsftpd (3.0.2) on port 21. I do not have login credentials and anonymous logins are disabled. Can I ...
4
votes
5answers
711 views

How insecure… really… is FTP?

Okay, we know the drill: don't use FTP, use SFTP or FTPS. But what exactly is the risk being posed? The files themselves are sent unencrypted, and this may be fine, or disastrous, depending on what ...
4
votes
2answers
214 views

From FTP to SSH

Currently, I am doing a penetration testing laboratory with a server with the following services: Nmap scan report for 10.0.11.125 Host is up (1.3s latency). Not shown: 998 closed ports PORT STATE ...
4
votes
1answer
117 views

Simple File Transfer Protocol

My SIEM has produced something intriguing. I went looking for unauthorized SSH connections, and looked for the SFTP protocol by mistake. I found a Windows web server that is connecting from port 80 to ...
1
vote
2answers
109 views

FortiClient VPN - WinSCP (FTP client)

Can I use FortiClient VPN access to secure my FTP client transfers? Is it possible to route the FTP to use the VPN? Does it make sense to do it, is it secure if possible? The reason I am asking this ...
-1
votes
1answer
92 views

How FTP can be connect under SSH so it become sftp? [duplicate]

I have seen this answer and it just tells the difference between SFTP and VPN ftp. But I am asking for How exactly SFTP works? The first SSH make a secure tunnel but then how do I use FTP?
0
votes
1answer
157 views

Filezilla for mac OS - Virus?

I hope this is the correct stack to post this. So I'm trying to download FileZilla for my macbook and I have McAfee installed, when I click in the download button, the antivirus flags it as Artemis!...
6
votes
1answer
2k views

Find the security hole on my site and prevent it [duplicate]

Last day I've noticed that my wordpress site is hacked and a PHP backdoor shell is installed on my site. Virus scanner reported that a plugin file is inside my wp-content/uploads which I did not ...
2
votes
3answers
169 views

What could happen if someone guessed a password to my FTP server?

I've always wondered what could realistically (and maybe theoretically) happen if one of those "always trying to log in with common passwords" remote addresses guessed my password and gained admin ...
7
votes
1answer
496 views

Security implications of not reusing SSL session in FTPS

I've just run into a problem with our FTPS server refusing connections due to missing SSL session reuse. Our client actually should reuse them, but it just doesn't work. I'm well aware that it's not ...
1
vote
2answers
81 views

How to enable OCSP stapling on my FTPS server. Is it even possible with vsftpd?

How to enable OCSP stapling on my FTPS server. Is it even possible with vsftpd or not? Even if possible, would it be wise on an FTPS server? Isn't that only a web-thing? Current result: High-Tech ...
0
votes
2answers
315 views

FTP over local network

If I am on a home network over a standard passphrase-protected router, is it safe* (definition below) to use FTP? * safe as in attackers not being able to see the contents to the FTP connection, ...
0
votes
1answer
123 views

How does malware connect to FTP servers without revealing credentials to the victim?

Let’s take an FTP based passwords stealer, or some keylogger, that uploads the details of our victims to our FTP server. How do they connect back to our FTP server? As far as I know that for ...
4
votes
2answers
920 views

How does a client authenticate an SFTP server if there are no keys shared in advance?

For FTPS, we rely on the DNS and public PKI to authenticate the FTP server when we first connect. On the first connection, foo.example.com resolves to 1.2.3.4 and my connection comes back encrypted by ...
0
votes
1answer
58 views

New files appearing on my web server (I did not create)

I recently had a keylogger on my computer recording usernames and passwords including their respective web addresses. I have changed all my passwords however on my web hosting account, in the FTP, ...
4
votes
3answers
377 views

Is it safe to use this embedded ftp server?

We are using a software suite for automation of FTP traffic. It uses the Apache Mina FtServer component as an embedded FTP server (for FTPS and SFTP). The use of this library has been flagged as a ...
3
votes
2answers
147 views

Does VPNs even protect ftp and virtual machines connections?

I have to go out for some days and I'll stay in a hotel. During these days I will also have to work on some websites code and VMs that call external APIs. Not being a system administrator nor a ...
2
votes
2answers
189 views

Does an unused ftp account pose a security risk?

I'm using BlueHost and have a few websites on my hosting. I decided to stop being lazy and start implementing some better security policies on my own part. Since FTP isn't secure, I changed to SFTP. ...
6
votes
1answer
178 views

If forced to download files using FTP, what steps can be taken to provide security?

I am in a situation where I must access data via FTP on a regular basis (for argument's sake, updated every 10 minutes). No other protocol is available for this operation. This data needs to be put ...
4
votes
1answer
159 views

Is checking a pre-shared fingerprint of a certificate good enough security for TLS?

A third party my system needs to connect to (via FTPS) is using a certificate that is not trusted by machine (unknown certificate). If I want to avoid installing the certificates from the issuing ...
3
votes
3answers
566 views

What is the purpose of opportunistic TLS (like STARTTLS)?

Opportunistic TLS refers to extensions in plain text communication protocols, which offer a way to upgrade a plain text connection to an encrypted (TLS or SSL) connection instead of using a separate ...
1
vote
0answers
2k views

Nmap scan of iPhone public IP address shows port 21 open

I'm using my iPhone personal hotspot to connect to the internet on my computer via usb connection. I don't go through any other router or connection. The phone is my only means of connecting my ...
4
votes
1answer
346 views

How was Freedom Hosting 2 hack possible?

Today I read about anonymous attack to Freedom Hosting II, and I was curious about step 3: How is possible to someone using a FTP client to create a symlink to /? Doesn't that require root access? ...
2
votes
1answer
227 views

FTP session opened from an unknown IP

I have a website made in Magento and hosted on an Ubuntu server and since a few months have been registering FTP connections open from unknown IP trying to open the file lic.php. In the proftpd.log ...
0
votes
0answers
42 views

SaaS Provider Requesting FTP Access

I recently discovered that a client gave root FTP access to a SaaS provider. The SaaS provider requested FTP information from the client, who was the owner and not a technical person. I believe the ...
5
votes
3answers
2k views

Detection for corruption in HTTP and FTP [closed]

How is data downloaded via HTTP or FTP checked for corruption? I know that TCP provides a 16-bit checksum field in its header, which is used for checking. Also torrents use a more powerful checksum ...
2
votes
3answers
2k views

What are the risks of using FTP?

Are the risks of using FTP essentially the same as the risks of using HTTP? That is my current understanding, and reading an answer (Risks of using HTTP when I trust the local network) on the topic ...
3
votes
3answers
87 views

Should my webhost show the root filesystem over FTP?

I use a commercial web host, when I log in via regular FTP this is how the directories looks like: It seems strange that I can access system files, I thought I would be limited to access files ...
2
votes
0answers
3k views

How to exploit a file upload to an IIS 5.1 [closed]

I found the following services in a testing environment: 21/tcp open ftp Microsoft ftpd 80/tcp open http Microsoft IIS httpd 5.1 The FTP server allows anonymous logins and ...
2
votes
2answers
412 views

FTP client development - firewall issues

I am working on FTP client for internal usage for deployments. I have started out with WinSCP scripts, everything seems to be working fine, except one operation (deleting large(many files) directory ...
1
vote
1answer
2k views

FTP Bounce attack, what's wrong?

I'm studying security in a training lab, and I'm trying to implement the infamous FTP-bounce attack. I'll use a remote FTP server (called BOUNCE here) in order to access a folder on the VICTIM ...
1
vote
1answer
323 views

Is an anonymous FTP user always a risk (even if this user doesn't have access to anything)?

I found some FTP servers in a network that seem to allow login with an anonymous FTP user. I confirmed this with the ftp-anon NSE script in Nmap. PORT STATE SERVICE 21/tcp open ftp |_ftp-anon: ...
28
votes
9answers
12k views

Is it safer to use a port other than 21 for FTP?

Usually (as far as I know), FTP uses port 21. Since this port is used for FTP so often, is it safer to use another port? My guess is that if someone with malicious intentions tries to break FTP ...
1
vote
1answer
75 views

Risk in FTP connect

excuse me the question perhaps beginner, but came out a doubt. One person asked me to edit your site, but it was very strange story and did not know this person yet ... When I connect me by filezilla, ...
0
votes
2answers
2k views

Why isn't FTPS, SFTP, or other protocols which use SSL/SSH on port 443/22?

ANSWER ON THE BOTTOM I'm in the process of taking my Security+ exam, and I was taught by the professor teaching me that, when trying to figure out what port to put a protocol on (as there are a LOT ...
27
votes
1answer
4k views

Why is it better to use ports 20 and 53 as source ports when portscanning?

I read that if a server is inside a DMZ behind a stateless firewall, it is a good idea to use ports 20 and 53 as source ports when conducting port scanning. Why is this a good idea? I guess the ...
2
votes
1answer
808 views

Does SFTP cost more to implement than FTP?

This is a two part question. How does the implementation of SFTP differ over FTP? (Account Creation, Setup of connection) Is it more expensive (in terms of time/cost) to do so? In this scenario I am ...
1
vote
2answers
1k views

How does SFTP work? Please help someone [closed]

We run a system that automatically sends a swift message at the end of a process. But this messages are sent using FTP. We feel the FTP process is too prone to MITMA and wish to change the sending ...
0
votes
0answers
69 views

How to block ftp password guessers in shared hosting?

Is this also possible for shared hosting to: 1.use a web software to block password guessing attempts 2.change ftp port 3.locking down access to specific source IP addresses If none of above is ...
1
vote
1answer
220 views

Is authorisation of FTP safe against sniffing and vulnerable to man-in-the-middle hijacking?

One of my hosting providers still just offers FTP access to the server... Is authorisation safe (i.e. resistant to network sniffing) despite the content of the transmission is plain text? Is it ...
0
votes
1answer
195 views

FTP access instead of SFTP [duplicate]

We want to provide access to upload files on a FTP server. How to provide the access for the same? What is difference between a FTP and SFTP server?
2
votes
1answer
118 views

Is storing passwords encrypted with GnuPGP on an anonymous FTP server safe?

I would like some advice on a method of storing passwords to a database on my anonymous FTP server. Basically I have login details for a few trusted users to a database server stored in a text file ...
85
votes
7answers
15k views

Does FTPS (FTP+S) offer better security than SFTP on the server side?

I had an exchange with some third party sysadmin yesterday regarding the setup of a file transfer interface between our servers. I suggested using SFTP because our application has good support for it....
3
votes
3answers
1k views

Is SFTP vulnerable to brute force, bounce, spoof, sniffing and port stealing?

I have been researching FTP and noted that using FTP means you are vulnerable to these types of attacks. I have been looking for an safer alternative and came across SFTP. Is SFTP still vulnerable to ...
3
votes
2answers
3k views

Setting up SFTP at Production Server is a Risk?

There is a requirement to setup a SFTP server. This will be used by some of user b2b agents to upload files. Such kind of setup is always doubtfully risky in production environment where user can ...
2
votes
1answer
911 views

Does FTPs (FTP over SSL using explicit TLS) support encryption of data channel?

I am exploring the ability of the FTPs(FTP over SSL using explicit TLS) to encrypt the data channel. I read online that the secure data channel can be entered by entering the PROT command. PROT P for ...
3
votes
3answers
558 views

Limiting FTP privileges on Windows Server

I currently have a Windows 2012 Server which is acting as a webserver running IIS. I am using Filezilla to host an FTP server to allow some clients FTP access to their own websites. I have setup the ...
3
votes
6answers
3k views

When is it safe to use a web based FTP client?

Is it safe to use a web based FTP client? If so, when? What should I watch out for?