Ftp

From Global Shellz Wiki
Jump to: navigation, search

FTP is the File Transfer Protocol.

It was not designed to be a secure protocol. As outlined by RFC 2577, FTP security flaws include (but are not limited to):

  • Bounce attacks ("The attack involves sending an FTP "PORT" command to an FTP server containing the network address and the port number of the machine and service being attacked.")
  • Spoof attacks (for servers which limit access based on network address)
  • Brute force attacks ("password guessing")
  • Packet capture (sniffing) -- as of standard FTP, all the data including the passwords is sent unencrypted. Security extensions are available RFC 2228 but this is not a part of standart FTP.
  • Username protection (issues with user identity guessing)
  • Port stealing
  • other FTP security issues related to software bugs rather than protocol issues

SFTP, the SSH File Transfer Protocol, should be used instead and is installed on GlobalShellz Servers.

Personal tools
Namespaces
Variants
Actions
Navigation
Toolbox