# HTB box Crocodile NAMP deafult scripts show port 21 with service vsFTPd 3.0.3 can connect to FTP client using [[rsync (FTP client)]] or [[FTP]] package via sudp apt-get install ftp -- not sure hat the distinct difference between these packages are using get command we can download the files using -sV on [[Nmap]] -p 80 we can see version on webserver Using browser plugin [[Wappalyzer]] we can see the tech stack behind the site, based on the code [[GoBuster]] can be used to enumerate directories on the webserver was able to detect login.php using the stolen exfil creds was able to login and get flag