# \[Day 9] Where Is All This Data Going

## Challenge

We are able to open the given pcap file with Wireshare to inspect it further.

![](/files/iTJuUG8t5Q1JdbiAaeAH)

```
http.request.method == GET
```

![](/files/i3kqAdoB1bSp9LZ5kHg8)

{% hint style="success" %}
In the HTTP #1 - GET requests section, which directory is found on the web server?

* login
  {% endhint %}

```
http.request.method == POST
```

![](/files/orjzYdjgw9ovXR2FrSMj)

![](/files/PNzeyvvR87EuUqIWlTF3)

{% hint style="success" %}
What is the username and password used in the login page in the **HTTP #2 - POST** section? 

McSkidy:Christmas2021
{% endhint %}

![](/files/X3SYLyLDpPRvXITqZ9mP)

{% hint style="success" %}
What is the User-Agent's name that has been sent in **HTTP #2 - POST** section?

* TryHackMe-UserAgent-THM{d8ab1be969825f2c5c937aec23d55bc9}
  {% endhint %}

```
udp.port == 53
```

![](/files/HSuMqwOcnJF3RMUJdY6H)

![](/files/LfLD3pKR3K8gzHLQ5ZMb)

{% hint style="success" %}
What is the flag in the message of that DNS query?

* THM{dd63a80bf9fdd21aabbf70af7438c257}
  {% endhint %}

```
tcp.port==21
```

![](/files/BglTB9TKtUMTOJgBYMFY)

{% hint style="success" %}
In the FTP section, what is the FTP login password

* TryH\@ckM3!
  {% endhint %}

![](/files/ICrdgWDHKu0GOTMoFYG8)

{% hint style="success" %}
In the FTP section, what is the FTP command used to upload the secret.txt  file?

* STOR
  {% endhint %}

```
ftp-data
```

![](/files/3ETOCtEA9cSr2dNnQGom)

![](/files/VsKJnlnaEagi5WZiyMbw)

{% hint style="success" %}
In the FTP section, what is the content of the secret.txt file?

* 123^-^321
  {% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://repo.4pfsec.com/tryhackme/advent-of-cyber-3-2021/day-9-where-is-all-this-data-going.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.