本节书摘来自异步社区《Nmap渗透测试指南》一书中的第9章9.2节审计FTP服务器，作者 商广明,更多章节内容可以访问云栖社区“异步社区”公众号查看。
9.2 审计FTP服务器表9.3所示为本章节所需Nmap命令表，表中加粗命令为本小节所需命令——审计FTP服务器。
操作步骤使用命令“nmap --script ftp-brute -p 21 目标”即可审计FTP服务器。
root@Wing:~# nmap --script ftp-brute -p 21 192.168.126.128 Starting Nmap 6.40 ( http://nmap.org ) at 2014-06-13 11:39 CST Nmap scan report for 192.168.126.128 Host is up (0.00027s latency). PORT STATE SERVICE 21/tcp open ftp | ftp-brute: | Accounts | No valid accounts found | Statistics | Performed 10 guesses in 9 seconds, average tps: 1 | |_ ERROR: Too many retries, aborted ... MAC Address: 00:0C:29:D3:9D:B9 (VMware) Nmap done: 1 IP address (1 host up) scanned in 8.39 seconds root@Wing:~#分析ftp-brute脚本可以暴力破解FTP账号密码，但上面没有破解成功，需要设置一个账号密码的字典进行爆破。
root@Wing:~# nmap --script ftp-brute --script-args userdb=user.txt,passdb=pass.txt -p 21 192.168.126.128 Starting Nmap 6.40 ( http://nmap.org ) at 2014-06-13 12:00 CST Nmap scan report for 192.168.126.128 Host is up (0.00025s latency). PORT STATE SERVICE 21/tcp open ftp | my-ftp-brute: | Accounts | admin:admin - Valid credentials | Statistics |_ Performed 510 guesses in 610 seconds, average tps: 0 MAC Address: 00:0C:29:D3:9D:B9 (VMware) Nmap done: 1 IP address (1 host up) scanned in 7.99 seconds root@Wing:~#设定了相关的账号密码字典后成功地破解出账号密码为admin。很多的FTP服务允许匿名登录，此时我们也可以使用ftp-anon脚本检测目标主机FTP服务是否允许匿名登录。
root@Wing:~# nmap --script=ftp-anon 192.168.1.103 Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-28 20:25 CST Nmap scan report for 192.168.1.103 Host is up (1.0s latency). Not shown: 986 closed ports PORT STATE SERVICE 21/tcp open ftp | ftp-anon: Anonymous FTP login allowed (FTP code 230) | drw-rw-rw- 1 user group 0 Jun 16 22:18 Untitled [NSE: writeable] |_drw-rw-rw- 1 user group 0 Jun 16 22:18 Untitled2 [NSE: writeable] 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 514/tcp filtered shell 843/tcp open unknown 902/tcp open iss-realsecure 912/tcp open apex-mesh 7000/tcp open afs3-fileserver 8000/tcp open http-alt 49152/tcp open unknown 49153/tcp open unknown 49155/tcp open unknown 49157/tcp open unknown Nmap done: 1 IP address (1 host up) scanned in 136.62 seconds root@Wing:~#从输出的信息可以得知，目标主机FTP服务允许匿名登录，并且发现Untitled、Untitled2两个目录。
