Unauthenticated enumeration

Nmap

sudo nmap -sV -p21 -sC -A -Pn <IP>

Netcat

nc -vn <IP> 21

You can use the commands HELP and FEAT and STAT to obtain some information of the FTP server.

Anonymous login

Manually

These are some typical anonymous credentials:

anonymous : anonymous

anonymous :

ftp : ftp

ftp <IP>
>anonymous
>anonymous
>ls -a # List all files (even hidden) (yes, they could be hidden)
>binary #Set transmission to binary instead of ascii
>ascii #Set transmission to ascii instead of binary
>bye #exit

Nmap

nmap --script ftp-* -p <IP>

NXC

Scan against a list of IPs using a list file and a single set of credentials:

nxc ftp scope_internal.txt -u 'anonymous' -p 'anonymous' --no-bruteforce