File transfer & sharingTCP 20, 21 Cleartext by default
Port 20, 21: FTP
File Transfer Protocol
FTP uses port 21 for commands and, in active mode, port 20 for data. Usernames, passwords and files all cross the network in plain text.
Secure alternative: SFTP (SSH, port 22) or FTPS (FTP over TLS, implicit on 990)
How attackers abuse it
- Credentials captured by anyone who can sniff the path.
- Anonymous login left enabled, exposing or accepting files.
- Old server software with known backdoors or overflows (vsftpd 2.3.4 is the classic lab example).
How to defend it
- Replace with SFTP or FTPS; disable plain FTP entirely.
- Disable anonymous access and restrict users to their own directories.
- Allow it only from known hosts if it must remain.
Exam tip
SFTP runs over SSH on 22; FTPS is FTP wrapped in TLS. They are different protocols despite the similar names.