Jump to content

FTP bounce attack

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Ira Leviton (talk | contribs) at 20:02, 25 June 2020 (Replaced outdated html codes with wikicodes.). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

FTP bounce attack is an exploit of the FTP protocol whereby an attacker is able to use the PORT command to request access to ports indirectly through the use of the victim machine, which serves as a proxy for the request, similar to an Open mail relay using SMTP.[1]

This technique can be used to port scan hosts discreetly, and to potentially bypass a network Access-control list to access specific ports that the attacker cannot access through a direct connection, for example with the nmap port scanner.[2]

Nearly all modern FTP server programs are configured by default to refuse PORT commands that would connect to any host but the originating host, thwarting FTP bounce attacks.

See also

References

  1. ^ M. Allman; S. Ostermann. "RFC 2577". doi:10.17487/RFC2577.
  2. ^ "ftp-bounce", Nmap Scripting Engine documentation