> For the complete documentation index, see [llms.txt](https://repo.4pfsec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://repo.4pfsec.com/tryhackme/advent-of-cyber-3-2021/day-9-where-is-all-this-data-going.md).

# \[Day 9] Where Is All This Data Going

## Challenge

We are able to open the given pcap file with Wireshare to inspect it further.

![](/files/iTJuUG8t5Q1JdbiAaeAH)

```
http.request.method == GET
```

![](/files/i3kqAdoB1bSp9LZ5kHg8)

{% hint style="success" %}
In the HTTP #1 - GET requests section, which directory is found on the web server?

* login
  {% endhint %}

```
http.request.method == POST
```

![](/files/orjzYdjgw9ovXR2FrSMj)

![](/files/PNzeyvvR87EuUqIWlTF3)

{% hint style="success" %}
What is the username and password used in the login page in the **HTTP #2 - POST** section? 

McSkidy:Christmas2021
{% endhint %}

![](/files/X3SYLyLDpPRvXITqZ9mP)

{% hint style="success" %}
What is the User-Agent's name that has been sent in **HTTP #2 - POST** section?

* TryHackMe-UserAgent-THM{d8ab1be969825f2c5c937aec23d55bc9}
  {% endhint %}

```
udp.port == 53
```

![](/files/HSuMqwOcnJF3RMUJdY6H)

![](/files/LfLD3pKR3K8gzHLQ5ZMb)

{% hint style="success" %}
What is the flag in the message of that DNS query?

* THM{dd63a80bf9fdd21aabbf70af7438c257}
  {% endhint %}

```
tcp.port==21
```

![](/files/BglTB9TKtUMTOJgBYMFY)

{% hint style="success" %}
In the FTP section, what is the FTP login password

* TryH\@ckM3!
  {% endhint %}

![](/files/ICrdgWDHKu0GOTMoFYG8)

{% hint style="success" %}
In the FTP section, what is the FTP command used to upload the secret.txt  file?

* STOR
  {% endhint %}

```
ftp-data
```

![](/files/3ETOCtEA9cSr2dNnQGom)

![](/files/VsKJnlnaEagi5WZiyMbw)

{% hint style="success" %}
In the FTP section, what is the content of the secret.txt file?

* 123^-^321
  {% endhint %}