Lab : Fawn

Fawn is a very easy Linux machine which explores the File Transfer Protocol (FTP) and its exploitation when misconfigured to allow anonymous access.

Task 1 - What does the 3-letter acronym FTP stand for?

File Transfer Protocol

Task 2 - Which port does the FTP service listen on usually?

21 (very important)

Task 3 - FTP sends data in the clear, without any encryption. What acronym is used for a later protocol designed to provide similar functionality to FTP but securely, as an extension of the SSH protocol?

SFTP (modern world FTP)

Task 4 - What is the command we can use to send an ICMP echo request to test our connection to the target?

ping (here we go again :P)

Task 5 - From your scans, what version is FTP running on the target?

vsftpd 3.0.3

Task 6 - From your scans, what OS type is running on the target?

Unix

Task 7 - What is the command we need to run in order to display the 'ftp' client help menu?

ftp -? (hard question takes time mostly thing -h but answer is hidden in question hint)

Task 8 - What is username that is used over FTP when you want to log in without having an account?

anonymous (usefull in ctf and bug bounty)

Task 9 - What is the response code we get for the FTP message 'Login successful'?

230 (general knowledge)

Task 10 - There are a couple of commands we can use to list the files and directories available on the FTP server. One is dir. What is the other that is a common way to list files on a Linux system.

ls (easy peasy in windows we use dir)

Task 11 - What is the command used to download the file we found on the FTP server?

get (yey)

---

Final flag and some questions can solve with some tools first try nmap then login ftp with anonymous after list files with ls and get the flag file to your local computer or pwn machine and read it with cat.