Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ever wondered how many open FTP servers there are?

github.com

Post reply on HN
Print view View original

71–80 of 100 posts

Re: Ever wondered how many open FTP servers there are?

#71

Post by p4bl0 »

I have a fun story about open FTP servers.

When we were undergrad students, a friend and I wondered exactly that same question about FTP servers. So we wrote a script that tested random IPv4 for FTP servers using nmap and then attempted to connect.

To our surprise we found quite a few. Most of them were small or not writable, but at least one of them was writable, and it had hundreds of GB of free space. So we connected to it, and then saw that it had huge data files containing what seemed like random junk.

Then, we tried to ssh to the box, but no ssh server was listening. So we tried to telnet in. That worked but we were prompted:

    Enter password:
Ah, too bad, we will never guess what the password is… Mh, let's try "123456" just in case… But then, instead of logging us in or telling us that we entered the wrong password, it simply said:

    Re-enter password:
Mh? So we re-entered "123456".

    The password has been set.
Haha! The owner must never have set this up. And then we were in. It was a very strange system with a few commands with standard names but non-standard behaviors, and a very minimalistic shell. By poking around and searching the web, we understood that we were actually connected to a surveillance camera and that the big files were probably parts of video.

Poking around more gave us access to other such cameras in the same network and more importantly to a web interface from which we could see the videos streaming live. We saw offices and people doing stuff like taking the garbage out (I don't know why but that is one of the more precise image I can recall ^^). The only distincive thing I remember was a big sign saying "Miami Fitness Club".

After that we never did anything about it as we had other things to do, but I kind of cherish this story as a nice souvenir of my first year at the ENS.

Re: Ever wondered how many open FTP servers there are?

#72

Post by a3_nm »

lucb1e wrote: post #57

S/he talks about it as if it's something bad, something unfixed. The whole thing sounds like it but in particular "[to be excluded] go fix your shit". I agree that if you don't want people to access it, you should secure it. Yet not all these servers are accidentally open: my ftp on 80.100.131.150 (I assume it's in there) hosts a copy of Damn Small Linux because all downloads were extremely slow or broken at the time…

Agreed. Having an open FTP server with read-only access is no more problematic than having an open HTTP server.

Re: Ever wondered how many open FTP servers there are?

#73

Post by acheron »

akshatpradhan wrote: post #66
Esau wrote: post #64

Earlier quoted context omitted.

"capitalizing Internet was still justifiable at the time" Given the Internet is a particular thing, shouldn't it still be used as a proper noun?

AP Style Alert. Internet and web are no longer to be capitalized. Check the googles.

They are 100% wrong and should not be encouraged.

Re: Ever wondered how many open FTP servers there are?

#74

Post by achillean »

andrewfromx wrote: post #59

any stats on how many servers are running Pure-FTPd vs. Paradise FTP vs. some other software?

There are ~300,000 Pure-FTPd instances: https://www.shodan.io/search?query=product%3Apure-ftpd+port%...

Not sure how to fingerprint Paradise FTP (searching for "Welcome to Paradise" also returned some non-relevant results) but there aren't many that contain "paradise" in their welcome banner.

Shodan also fingerprints lots of other FTP software (check out the "Top Products" section):

https://www.shodan.io/report/WHJBsZqV

ProFTPD is by far the most popular choice at the moment.

Note: Doing a search that uses a filter (ex: "product") requires a free Shodan account. None of the above require paid access, you just need a free account.

Re: Ever wondered how many open FTP servers there are?

#75

Post by walterbell »

akshatpradhan wrote: post #66
Esau wrote: post #64

Earlier quoted context omitted.

"capitalizing Internet was still justifiable at the time" Given the Internet is a particular thing, shouldn't it still be used as a proper noun?

AP Style Alert. Internet and web are no longer to be capitalized. Check the googles.

Language mostly evolves by usage, not mandate.

Re: Ever wondered how many open FTP servers there are?

#77

Post by sprocket »

repler wrote: post #76

> consider piping the list through shuf each time you try something new. You know why. No, I don't know why. Can someone explain? (without being condescending, preferably)

It's not entirely clear to me either, though I would assume it's so that the first server in the list doesn't get constantly hammered by a hundred people going through the list sequentially.

Re: Ever wondered how many open FTP servers there are?

#78

Post by repler »

sprocket wrote: post #77
repler wrote: post #76

> consider piping the list through shuf each time you try something new. You know why. No, I don't know why. Can someone explain? (without being condescending, preferably)

It's not entirely clear to me either, though I would assume it's so that the first server in the list doesn't get constantly hammered by a hundred people going through the list sequentially.

hmm. Yeah that makes sense.

Would be better if they simply stated that instead of playing insinuation based guessing games.

Re: Ever wondered how many open FTP servers there are?

#79

Post by saganus »

p4bl0 wrote: post #71

I have a fun story about open FTP servers. When we were undergrad students, a friend and I wondered exactly that same question about FTP servers. So we wrote a script that tested random IPv4 for FTP servers using nmap and then attempted to connect. To our surprise we found quite a few. Most of them were small or not writable, but at least one of them was writable, and it had hundreds of GB of free space. So we connec…

I remember doing something similar except it was with my cable provider, when they first came into town.

Since all clients would basically be connected to a LAN, as soon as I found I could port scan random users I started doing it.

Of course there were a lot of businesses on the network that apparently used FTP to move files around but were unsecured.

I spent the better part of a couple of weeks just going through the data (never actually downloaded anything since I knew it could land me in trouble with my parents).

Like you said, I also cherish this story since it was a rare peak at other peoples lives... without even knowing a 12 year old had access to all their business files.

Re: Ever wondered how many open FTP servers there are?

#80

Post by kragen »

Esau wrote: post #64
kragen wrote: post #14

I got my first internet account on my high school's VAX in 1992 in order to download Dr. Dobb's code from ftp.mv.com. The VAX had a help file installed which was a list of thousands of anonymous FTP servers, most of which requested that you please not use anonymous FTP during business hours to avoid overloading them; shortly I was downloading all kinds of things from wuarchive.wustl.edu (which had a LOT of stuff) and…

"capitalizing Internet was still justifiable at the time" Given the Internet is a particular thing, shouldn't it still be used as a proper noun?

That isn't the rule in English; the telephone system is also still a particular thing, as is the ocean, the sky, and the air.

What would you think if someone asked you to call them "on the Telephone"?

Post reply on HN