> For the complete documentation index, see [llms.txt](https://repo.4pfsec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://repo.4pfsec.com/tryhackme/advent-of-cyber-3-2021/day-9-where-is-all-this-data-going.md).

# \[Day 9] Where Is All This Data Going

{Network Forensics}

## Challenge

We are able to open the given pcap file with Wireshare to inspect it further.

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2Fa1LFp71AO6mjXvp5iDEX%2Fimage.png?alt=media\&token=a1fc6d5c-31a2-4759-84fc-2c7a3ce0dd4e)

```
http.request.method == GET
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FUJNk0s9fNFSQbn8UeiW7%2Fimage.png?alt=media\&token=e6244218-f3bd-4a4a-8803-342f111865dd)

{% hint style="success" %}
In the HTTP #1 - GET requests section, which directory is found on the web server?

* login
  {% endhint %}

```
http.request.method == POST
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FSehnFo8VXrExPlPag6a8%2Fimage.png?alt=media\&token=7e390560-3c9c-4c7f-aeb4-a4a654d9bcba)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F4keB4sjelZxVg9RzCQnG%2Fimage.png?alt=media\&token=d3d607f9-678f-4a56-80ec-bd7e2984dd96)

{% hint style="success" %}
What is the username and password used in the login page in the **HTTP #2 - POST** section? 

McSkidy:Christmas2021
{% endhint %}

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F194mmHltlP3QaJbmFMXu%2Fimage.png?alt=media\&token=c8045d64-039c-4ba1-aa49-6b2faf72ee95)

{% hint style="success" %}
What is the User-Agent's name that has been sent in **HTTP #2 - POST** section?

* TryHackMe-UserAgent-THM{d8ab1be969825f2c5c937aec23d55bc9}
  {% endhint %}

```
udp.port == 53
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FdgYBYM8Lr8tCKANgNCqN%2Fimage.png?alt=media\&token=b26d334f-bda3-4bdd-9ea6-356b63f39944)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2F2cHmGAzuQEd3VF6Al856%2Fimage.png?alt=media\&token=31a3e384-efa0-4132-b59a-6c6e920bd978)

{% hint style="success" %}
What is the flag in the message of that DNS query?

* THM{dd63a80bf9fdd21aabbf70af7438c257}
  {% endhint %}

```
tcp.port==21
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FlFXsHtSpch9LgnpTdJQQ%2Fimage.png?alt=media\&token=998f2935-4ce2-463d-b060-ed1351812d37)

{% hint style="success" %}
In the FTP section, what is the FTP login password

* TryH\@ckM3!
  {% endhint %}

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FDQuLf34hG1sBQB7vTndR%2Fimage.png?alt=media\&token=7d66d821-d363-4aa1-a8d2-23623c86b9a1)

{% hint style="success" %}
In the FTP section, what is the FTP command used to upload the secret.txt  file?

* STOR
  {% endhint %}

```
ftp-data
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FWt966qei8dBDb6cJrLoE%2Fimage.png?alt=media\&token=dd672fd5-3008-4722-94c8-d1400f713948)

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdOcy1ba9EGn2GQ7ELK%2Fuploads%2FCLGBkvVd97vQujJKo6RJ%2Fimage.png?alt=media\&token=a9c7bcbb-c5ba-4320-9cd4-eb62af15c620)

{% hint style="success" %}
In the FTP section, what is the content of the secret.txt file?

* 123^-^321
  {% endhint %}