Remote access

FileZilla Saved Site Credentials

FileZilla saved-site files can contain FTP, FTPS, or SFTP connection details and saved passwords.

Metadata

  • id: remote-access.filezilla-sites
  • category: remote-access
  • sensitivity: critical
  • subcategory: filezilla
  • artifact types: credential, configuration
  • tags: filezilla, ftp, sftp

Path Matchers

PathKindPlatforms
%APPDATA%\FileZilla\recentservers.xmlfilewindows
%APPDATA%\FileZilla\sitemanager.xmlfilewindows
$HOME/.config/filezilla/recentservers.xmlfilemacos
$HOME/.config/filezilla/sitemanager.xmlfilemacos

Content Indicators

Literal strings:

  • Server
  • Host
  • User
  • Pass

Credential Types

  • password

Impact

  • credential_access
  • remote_access

References

On this page