How To

Today I needed to FTP some files to a site that I have used on and off for a number of years. Because I have recently installed Windows 7 I needed to setup the site again in my FTP Client, Core FTP.

Although my old machine still has the connection setup I was not able to see the cached/saved password. Although it is possible to export the sites, the password remained encrypted and I wanted to document the actual password.

There are a lot of tools, some free and some which you have to pay for which will recover the cached FTP password for you. Some of these looked a bit questionable and as FTP is an entirely unencrypted service I thought it should be easy to sniff the password out of the FTP traffic itself.

Turns out that it really is very easy and the saved password can be retreived instantly using netmon.

So here is how to do it.

Create a new capture filter in netmon and enter the following:

tcp.Port==21 and property.TCPPayload.contains("PASS")

Should look like this:

Then click on the start button to begin capture. Then open your FTP client which contains the cached password and connect to the FTP server.

As soon as you have made a succesful connection switch back to netmon and stop the capture. You should then be able to see the FTP password in clear text in the capture window, something like this:

I spotted a lot of posts from people trying to recover or export their saved FTP passwords from CoreFTP and CuteFTP and many programs are designed specifically for this purpose. This is quick and simple and does not depend on any 3rd party software and should work with any FTP client.

Hope this helps someone.