Enumeration

Mandatory

1. Check anony­mous login
2. Try to cre­ate AND upload a file:
   • mkdir test
   • put /tmp/test test
3. Check login with at least the fol­low­ing credentials:
   • admin / admin
   • admin / password

Optional

• Down­load every­thing with wget and look for .dot files!
• Check login with new­ly found users
• Brute-force login
  • Make sure to check admin / admin and oth­er usu­al com­bi­na­tions and DON’T relay on a pass­word list like best110.txt only!
• Down­load the whole content
• Check for FTP serv­er exploits
• Try
  • ../
  • cd /
  • cd C:\
  • cd C:\\
  • get $file_which_should_be_on_the_os

Tools

• Pata­tor (brute force)