Here is a ftp vulnerability scanner:

-----[ cut here, ftpscan.c ]-----
/* 
 * ftpscan 1.o - by vENOMOUS of rdC - Mar 29, 1999
 *
 * This will open a specific file [-f file], get the IPs from it,
 * then, check if FTP port [ -p 21 ] is open and log  the  version.
 * If you specify the [ -o ] flag  it will try log into the FTP
 * and execute LIST command [recursive], this is usefull 
 * for see if there are any world writeable directories.
 *
 * You should know what you can do with that.
 *
 * credits: localip (lip) routine has been taken from queSO.
 *
 * Greets: ka0z [!thanks for the help, ideas and advices buddy!] - meengo
 *         #rdC - ub
 *
*/

#include <stdio.h>
#include <string.h>
#include <netdb.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/time.h>
#include <unistd.h>
#include <errno.h>
#include <time.h>
#include <signal.h>
#include "blah.h"    /* taken from queSO */

char rdcopenfile(char g0d[257]);
void usage(char *damn);
void RDCconnect2(char host[1000], int puerto);
int bindit(int socket_type, u_short port, int *listener); 
void sigh(int z);
u_long lip(void); /* QueSO */

FILE *file;
FILE *fileout;

char ipsfile[256],
     bleh[100000][200],
     homer[256],
     beer[256],
     huhense[32];

u_long localip; 

int sockfd,
    leen2=0,
    listing=0,
    sockfd1,
    ip1=0, 
    ip2=0, 
    ip3=0, 
    ip4=0, 
    lsock=-1,
    port2=-1,
    lala=0,
    dfinder=0,
    gotit=0,
    xx=0;
 
int main(int argc, char **argv)
{
char arg;

int  p0rt=21;

  if ( argc < 3 ) 
        { 
  usage(argv[0]); 
  }
  
  while ((arg = getopt(argc, argv, "f:p:o")) != EOF)
  {
    switch(arg)
    {
      case 'f':
         strncpy(ipsfile,optarg,128);
         break;
      case 'p':
         p0rt = atoi (optarg);
         break;
      case 'o':
         listing = 1;
         break;
      default:
         usage(argv[0]);
      break;

    }
  }
  while (dfinder < 5)
    {
       char disp[500];
      sprintf(disp,"ppp%d",dfinder);
      strcpy(huhense,disp);
      localip = lip();
      sscanf((char *) inet_ntoa(localip),"%d.%d.%d.%d", &ip1, &ip2, &ip3, &ip4);
      if ((ip3 && ip4) != 0)
        {
          gotit=1;
          break;
        }
      dfinder++;
    }

  dfinder=0;
  if (gotit == 1)
    dfinder=6;
  while (dfinder < 5)
    {
       char disp[500];
      sprintf(disp,"eth%d",dfinder);
      strcpy(huhense,disp);
      localip = lip();
      sscanf((char *) inet_ntoa(localip),"%d.%d.%d.%d", &ip1, &ip2, &ip3,&ip4);
      if ((ip3 && ip4) != 0)
        {
          gotit=1;
          break;
        }
      dfinder++;
    }

  if (gotit == 0)
  {
    fprintf(stdout,"\nCannot define local ip address, aborting!\n\n");
    fflush(stdout);
    exit(1);
  }

  fprintf(stdout,"Local IP is %s\nStarting Scan...  \n\n",inet_ntoa(localip));
   fflush(stdout);

  sprintf(beer,"PORT %d,%d,%d,%d,69,%d\nLIST -lR\n", ip1, ip2, ip3 ,ip4, 222 + lala);
  strlen(beer);

  rdcopenfile(ipsfile);
  for (xx = 0 ; xx < leen2 ; xx++)
    {
      RDCconnect2(bleh[xx], p0rt);
      lala++;
    }
}

char rdcopenfile(char g0d[257])
{
int x;

   /* see if the file can be read... */
  if ((file=fopen(g0d,"r")) == NULL) 
  {
    printf("\nftpscan 1.o by vENOMOUS of rdC - venomous@iname.com - o3/99\n");
          printf("\nCannot open file %s for reading\n\n", g0d);
    exit(1);
  }
  /* get the all the lines */
  for ( ; fgets(bleh[leen2], 190, file) != NULL ; leen2++);
  fclose(file);
}


void RDCconnect2(char host[1000], int puerto)
{
char versi0n[5000];
int nmb;
        struct sockaddr_in beb;
        struct hostent *d0h;
//  struct timeval timev; 
  beb.sin_family = AF_INET;
        beb.sin_port = htons(puerto);
  d0h = gethostbyname(host);
  if (!d0h) 
  {
    if ( (beb.sin_addr.s_addr = inet_addr(host)) == INADDR_NONE) 
      {
        printf("\nftpscan 1.o by vENOMOUS of rdC - venomous@iname.com - o3/99\n");
        printf("\nPut a correct address\n\n");
        exit(0);
      }
  } else
    {
         bcopy( d0h->h_addr, (struct in_addr *) &beb.sin_addr, d0h->h_length);
    }

        strcpy(homer,"unable to connect: Connection refused");
  sockfd = socket(AF_INET, SOCK_STREAM,0);
  fprintf(stdout,"\n------------------------------------------------------------------------------n");
        fprintf(stdout,"IP: %s", host);
  fflush(stdout);
        signal(SIGALRM, sigh);
        alarm(10); 
        if(connect(sockfd, (struct sockaddr *)&beb, sizeof(struct sockaddr)) < 0)
          {
       fprintf(stdout,"%s\n\n",homer);
            fflush(stdout);
      return;

    }
  alarm(0);
  bzero(versi0n, sizeof(versi0n));
  if ((nmb = recv(sockfd, versi0n, 5000, 0)) == -1)
    {
      fprintf(stdout,"Connection reset by peer?\n\n");
      fflush(stdout);
    } 
  if (strlen(versi0n) == 0)
    {
      close(sockfd);
      return;
    }
  if (strstr(versi0n,"Microsoft") != NULL)
    {
      fprintf(stdout,"Skipping host, cuz its runing wind0ze\n\n");
      fflush(stdout);
      close(sockfd);
      return;
    }
  if (strstr(versi0n,"WinSock") != NULL)
    {
      fprintf(stdout,"Skipping host, cuz its runing wind0ze\n\n");
      fflush(stdout);
      close(sockfd);
      return;
    }
  if (strstr(versi0n,"NetWare") != NULL)
    {
      fprintf(stdout,"Skipping host cuz its runing NetWare\n\n");
      fflush(stdout);
      close(sockfd);
      return;
    }
  if (strstr(versi0n,"Proxy Server") != NULL)
    {
      fprintf(stdout,"Runing ProxyServer, skipping host\n\n");
      fflush(stdout);
      close(sockfd);
      return;
    }

        fprintf(stdout,"FTP banner:\n");
  fprintf(stdout,"%s\n",versi0n); 
        fflush(stdout);
  if (listing == 1)
                {
                   char username[70],
      sendear[17200],
      listit[100];
      
      int n;

      /* login in */
      strcpy(username,"anonymous");
                        sprintf(sendear,"USER %s\n",username);
                        fprintf(stdout,"Login as: %s\n",username);
      write(sockfd,sendear,strlen(sendear));
      read(sockfd,sendear,sizeof(sendear));
      if (strstr(sendear,"denied") != NULL)
      {
        fprintf(stdout,"Anonymous access denied, skipping\n\n");
        close(sockfd);
        return;
      }
      if (strstr(sendear,"USER anonymous") != NULL)
      {
        fprintf(stdout,"Remote host has closed the connection.\n\n");
        close(sockfd);
        return;
      }
      if (strstr(sendear,"unknown") != NULL)
      {
        fprintf(stdout,"Anonymous access unknown\n\n");
        close(sockfd);
        return;
      }
      if (strstr(sendear,"not found") != NULL)
      {
        fprintf(stdout,"User anonymous not found\n\n");
        close(sockfd);
        return;
      }
                        fprintf(stdout,"Answer: %s\n",sendear);
                        bzero(sendear, sizeof(sendear));
      fprintf(stdout,"Using password: bleh@\n");
      write(sockfd,"PASS bleh@\n",11);
            read(sockfd,sendear,sizeof(sendear));
      if (strstr(sendear,"Can't set") != NULL)
      {
        fprintf(stdout,"Cant set guest privileges\n\n");
        close(sockfd);
        return;
      }
                        fprintf(stdout,"Answer: %s\n",sendear);
      bzero(sendear, sizeof(sendear));
      fprintf(stdout,"Setting PORT to %d\n",17886+lala);
                        bzero(beer,sizeof(beer));
      sprintf(beer,"PORT %d,%d,%d,%d,69,%d\nLIST -lR\n",ip1, ip2, ip3 ,ip4, 222 + lala);
      write(sockfd,beer,strlen(beer) + 4);
      read(sockfd,beer,sizeof(beer)); 
      /* bind the port for data transfer */
      sockfd1 = bindit(SOCK_STREAM, port2, &lsock);
                        read(sockfd,sendear,sizeof(sendear)); 
      fprintf(stdout,"Using LIST command\n");
      fprintf(stdout,"Answer: %s\n",sendear); 
      bzero(sendear, sizeof(sendear));  
      read(sockfd1,sendear,sizeof(sendear));
      fprintf(stdout,"Recursive list:\n %s\n",sendear);
      bzero(sendear, sizeof(sendear));
      fflush(stdout);
    //  lala++;
              } 
  close(sockfd);
  close(sockfd1);
}
  
int bindit(int socket_type, u_short port, int *listener)
{
struct sockaddr_in address;
int listening_socket;
int connected_socket = -1;
int reuse_addr = 1;
char sendear[17200];

  port = htons(17886+lala);
  memset((char *) &address, 0, sizeof(address));
  address.sin_family = AF_INET;
  address.sin_port = port;
  address.sin_addr.s_addr = htonl(INADDR_ANY);

  listening_socket = socket(AF_INET, socket_type, 0);
  if (listening_socket < 0) 
  {
    fprintf(stdout,"Cant recive list.\n\n");
     fflush(stdout);
    return;
   }

  if (listener != NULL)
        *listener = listening_socket;

  setsockopt(listening_socket, SOL_SOCKET, SO_REUSEADDR, &reuse_addr, sizeof(reuse_addr));

  if (bind(listening_socket, (struct sockaddr *) &address, sizeof(address)) < 0) 
  {
    fprintf(stdout,"Error\n\n");
    fflush(stdout);
    close(listening_socket);
    exit(1);
   }
   
  listen(listening_socket, 1);
  signal(SIGALRM, sigh);
  alarm(10);
   
  while(connected_socket < 0) 
   {
    connected_socket = accept(listening_socket, NULL, NULL); 
  }
}

void sigh(int z)
{
  alarm(0);
  signal(SIGALRM, SIG_DFL);
  strcpy(homer,"Unable to connect: timeout");
}


u_long lip (void)
{
  int pvto,
      yesto,
      traversal;
  struct sockaddr_in *dim0n;
  struct ifreq *i;
  struct ifconf ic;
  char bufercito[512];

  pvto = socket (AF_INET, SOCK_STREAM, 0);
  ic.ifc_pum = 512;
  ic.ifc_buf = bufercito;
  ioctl (pvto, SIOCGIFCONF, (char *) &ic);
  i = ic.ifc_req;
  yesto = (ic.ifc_pum / sizeof(struct ifreq));
  for (traversal = 0; traversal < yesto; traversal++) {

      ioctl(pvto, SIOCGIFADDR, (char *) &i);
      dim0n = (struct sockaddr_in *) &i->ifr_ifru.ifru_addr;
      if (!strcmp (i->ifr_name, huhense))
      return dim0n->sin_addr.s_addr;
      i++;
      }
}

void usage(char *damn)
{
printf("\n<[(  ftpscan 1.o by vENOMOUS of rdC - venomous@iname.com - o3/99 )]>");
printf("<[(  usage:\n");
printf("<[(        %s -f file [-p port] [-o]\n\n",damn);
printf("<[( -f file: file is the IPs file.\n");
printf("<[( -p port: port to connect to, default 21.\n");
printf("<[(      -o: with this flag, ftpscan will log into the FTPserver\n");
printf("<[(          as anonymous, and do a recursive list.\n\n");
exit(0);
}

-----[ end of ftpscan.c ]-----


-----[ cut here, blah.h ]-----

#include <stdio.h>
#include <fcntl.h>
#include <linux/sockios.h>
#include <unistd.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/ip_icmp.h>
#include <errno.h>
#include <string.h>

#define NOMBRESIZE      16

struct ifmap
{
        unsigned long mem_start;
        unsigned long mem_end;
        unsigned short base_addr;
        unsigned char irq;
        unsigned char dma;
        unsigned char port;
        /* 3 bytes spare */
};
struct ifreq
{


        union
        {
                char    ifrn_name[NOMBRESIZE];         /* if name, e.g.  "en0" */
        } ifr_ifrn;
        union {
                struct  sockaddr ifru_addr;
                struct  sockaddr ifru_dstaddr;
                struct  sockaddr ifru_broadaddr;
                struct  sockaddr ifru_netmask;
                struct  sockaddr ifru_hwaddr;
                short   ifru_flags;
                int     ifru_metric;
                int     ifru_mtu;
                struct  ifmap ifru_map;
                char    ifru_slave[NOMBRESIZE];   /* Just fits the size */
                caddr_t ifru_data;
        } ifr_ifru;
};

#define ifr_name        ifr_ifrn.ifrn_name      /* interface name       */
#define ifr_hwaddr      ifr_ifru.ifru_hwaddr    /* MAC address          */
#define ifr_addr        ifr_ifru.ifru_addr      /* address              */
#define ifr_dstaddr     ifr_ifru.ifru_dstaddr   /* other end of p-p lnk */
#define ifr_broadaddr   ifr_ifru.ifru_broadaddr /* broadcast address    */
#define ifr_netmask     ifr_ifru.ifru_netmask   /* interface net mask   */
#define ifr_flags       ifr_ifru.ifru_flags     /* flags                */
#define ifr_metric      ifr_ifru.ifru_metric    /* metric               */
#define ifr_mtu         ifr_ifru.ifru_mtu       /* mtu                  */
#define ifr_map         ifr_ifru.ifru_map       /* device map           */
#define ifr_slave       ifr_ifru.ifru_slave     /* slave device         */
#define ifr_data        ifr_ifru.ifru_data      /* for use by interface */

struct ifconf
{
        int     ifc_pum;                        /* size of buffer       */
        union
        {
                caddr_t ifcu_buf;
                struct  ifreq *ifcu_req;
        } ifc_ifcu;
};
#define ifc_buf ifc_ifcu.ifcu_buf               /* buffer address       */
#define ifc_req ifc_ifcu.ifcu_req               /* array of structures  */

-----[ end of blah.h ]-----

Have fun!