Home / server / Questions / 94466
Accepted
Olivier Lalonde
Asked: 2009-12-16 01:31:39 +0800 CST

FTP server that logs failed password attempts

  • 772

I'm looking for a FTP server that logs failed password attempts in clear text. The thing is that I've lost a password which is saved in my FTP client but it is encrypted obviously. What I wanted to do was simply change the server IP so it tries to connect on localhost with the saved password. I could then recover the saved password from my logs. If you have any idea of another way to recover my password, let me know !

log-files

3 Answers

  1. Best Answer

    FTP normally passes the password in cleartext (i.e. not encrypted). To recover the password:

    • Run a network traffic capture program, such as Wireshark on your machine.
    • Start logging traffic (in Wireshark, goto Capture -> Interfaces to start off)
    • Login to the FTP server
    • Find the request in the traffic log, and locate the PASS ... command: Here you'll find your password:

    Example using Wireshark

    • 3

  2. The password may be encrypted, but is obviously accessible to your FTP client, so you could probably recover it with the right "password recovery" tool.

    Or check out Wireshark: http://en.wikipedia.org/wiki/Wireshark

    If the client sends the password in cleartext it could be logged by wireshark.

    • 1

  3. Using wireshark will no doubt do the trick. A possibly even simpler solution is using netcat to pretend that you are an ftp server. All you have to do is to send the responses 220 and 331, and they client should happily respond in kind.

    # netcat -lp 21
220
USER andreas
331
PASS s3cr3t
^C
    • 1