Apple Filing Protocol (AFP)
Apple Filing ProtocolAFPmacOS File Sharing
Apple Filing Protocol (AFP) is the file sharing protocol used by macOS. Older versions are vulnerable to credential disclosure and unauthenticated access.
Ports
| Port | Protocol | Description |
|---|---|---|
| 548 | tcp | AFP over TCP |
| 427 | tcp/udp | AFP Service Location |
Fingerprints
| Banner / Probe | Expected Response |
|---|---|
nmap -sV -p <port> <target> | Service banner and version info |
nc -nv <target> <port> | Raw banner grab |
Key Files
| Path | Description |
|---|---|
/etc/passwd | List of system users |
/etc/shadow | Password hashes for local users |
/etc/ssh/sshd_config | SSH server configuration |
~/.ssh/id_rsa | SSH private key |
Default Credentials
| Username | Password | Context |
|---|---|---|
admin | admin | Generic admin account |
root | root | Generic root account |
Known CVEs
| Identifier | Type | Description |
|---|---|---|
— | Info | Check NVD database for latest CVEs |
Exploitation Primitives
| Technique | Tool / Command | Result |
|---|---|---|
| Recon | nmap -sV -sC -p- <target> | Full port/service scan |
| Enumeration | nmap --script <service>-* -p <port> <target> | Service-specific NSE scripts |
Notes
Always start with full port scan: `nmap -sV -sC -p- <target>`.
Check for default credentials before brute-forcing.
Use service-specific NSE scripts: `nmap --script <service>-* -p <port> <target>`.
Remember to check both IPv4 and IPv6 if applicable.
Seen on
ShodanCensysFOFAZoomEye
References