# Write-up
### Task 1: Enumerating Ports (1-9999)
*What is the highest port number being open less than 10,000?*
We start by running an **nmap** scan on ports 1-9999:
```bash
sudo nmap -p1-9999
```
Answer: 8080
***
### Task 2: Enumerating Ports (10000-65535)
*There is an open port outside the common 1000 ports; it is above 10,000. What is it?*
To speed up the next scan, we add the **-T5** flag for aggressive timing:
```bash
sudo nmap -p10000-65535 -T5
```
Answer: 10021
***
### Task 3: Counting Open Ports
*How many TCP ports are open?*
Using the results from the previous scans, we simply count the number of open ports found to answer this question.
Answer: 6
***
### Task 4: Finding the HTTP Service
*What is the flag hidden in the HTTP server header?*
The HTTP service is hosted on port **80**. We visit the web page at:
```bash
http://:80
```
In the browser's developer tools (Network tab), we find the flag displayed on the right side.
***
### Task 5: Checking SSH via Telnet
*What is the flag hidden in the SSH server header?*
For the next task, we need to verify SSH connectivity using **telnet**:
```bash
telnet 22
```
***
### Task 6: Investigating FTP on Port 10021
*We have an FTP server listening on a nonstandard port. What is the version of the FTP server?*
Among the discovered ports, **10021** is marked as unknown. Let's run another **nmap** scan to investigate further:
```bash
sudo nmap -sV -p10021
```
***
### Task 7: Brute-Forcing FTP Credentials
*We learned two usernames using social engineering: eddie and quiin. What is the flag hidden in one of these two account files and accessible via FTP?*
To brute-force the FTP credentials, we use **`Hydra`** with the **rockyou.txt** wordlist. We start with the user **eddie**:
```bash
hydra -l eddie -P /usr/share/wordlists/rockyou.txt ftp://:10021
```
We found the password; however, there was no content in the FTP directory. Let's try the other user **quinn**:
```bash
hydra -l quinn -P /usr/share/wordlists/rockyou.txt ftp://:10021 -v
```
This attempt is successful.
### Task 8: Stealth Scanning for the Final Flag
*Browsing to displays a small challenge that give you a flag once you solve it. What is the flag?*
For the final task, we access the web service on port **8080**:
```bash
http://:8080
```
We are instructed to perform a cautious scan to avoid detection by the IDS. To achieve this, we use a null scan:
```bash
sudo nmap -sN
```
After the scan completes, we revisit the web page to find the final flag.
