Networking Core Protocols: DNS, Web, FTP, and Email Fundamentals

Introduction

Welcome to my walkthrough for the TryHackMe room Networking Core Protocols!

In my previous article, Networking Essentials, we explored how core network mechanisms allow devices to configure IP addresses, resolve physical hardware locations, diagnose connectivity, and route traffic across local and global networks.

In this third room of the networking series, we elevate our focus to Application Layer (Layer 7) protocols. We will dissect how human-readable domain names map to IP addresses, how public registration databases track ownership, how web content and files are transferred, and how email messages travel across sender and recipient servers.

If you missed the previous entry in this series, you can catch up on my walkthrough for Networking Essentials below.

What we will cover

• Core Application Layer protocols including DNS, WHOIS, HTTP/HTTPS, FTP, SMTP, POP3, and IMAP.
• Hands-on command-line interaction with web and mail services using telnet and ftp.
• Detailed answers and step-by-step solutions to all room tasks.

Room Information

Before diving into the technical tasks, here is a quick overview of the room details.

• Room Name: Networking Core Protocols
• Path: Cyber Security 101
• Module: Networking
• Topic: Application Layer Protocols
• Difficulty: Easy
• Room Link: TryHackMe — Networking Core Protocols

Task 1: Introduction

This room serves as the third module in TryHackMe's four-part networking series, building directly upon the foundations established in Networking Concepts and Networking Essentials. Before beginning this task, you should be familiar with the ISO OSI and TCP/IP reference models, along with core lower-layer protocols such as Ethernet, IP, ARP, and TCP.

Learning Objectives

Throughout this module, you will gain hands-on operational knowledge of the following essential Application Layer protocols:

• WHOIS & DNS: Domain registration tracking and hostname-to-IP resolution.
• HTTP & FTP: Web communications and efficient file transfer mechanisms.
• SMTP, POP3, & IMAP: Mail transmission, retrieval, and multi-device mailbox synchronization.

Environment Setup

To follow along with the hands-on exercises starting in Task 4, click the Start AttackBox button at the top of the page, then start the target virtual machine using the Start Lab Machine button attached to Task 4. Allow approximately 2 to 3 minutes for both environments to boot up completely.

Task 2: DNS: Remembering Addresses

While humans navigate the web using easy-to-remember text domain names like example.com, networking infrastructure routes traffic purely using numerical IP addresses. The Domain Name System (DNS) functions as the internet's phonebook, dynamically translating human-readable hostnames into Layer 3 IP addresses.

Operating at the Application Layer (Layer 7) of the OSI model, DNS communicates primarily over UDP port 53 for standard queries due to its low overhead, falling back to TCP port 53 for larger data transfers or zone updates.

Primary DNS Record Types

DNS relies on distinct record types to store various categories of domain information:

• A Record: Maps a hostname directly to an IPv4 address (e.g., example.com resolving to 93.184.215.14).
• AAAA Record: Maps a hostname to an IPv6 address. The "quad-A" designation distinguishes it from single-A IPv4 records.
• CNAME Record: Creates an alias from one domain name to another canonical domain name (e.g., pointing www.example.com to example.com).
• MX Record: Specifies the mail exchange servers responsible for accepting incoming email on behalf of the domain.

Querying DNS Records

When a user visits a website, the browser queries local or upstream DNS resolvers for the domain's A or AAAA records. Command-line utilities like nslookup or dig allow administrators to perform these queries manually:

user@TryHackMe nslookup www.example.com

user@TryHackMe nslookup www.example.com

Running this query retrieves both the IPv4 address (93.184.215.14) and IPv6 address (2606:2800:21f:cb07:6820:80da:af6b:8b2c) associated with the requested host.

Questions and Answers

Which DNS record type refers to IPv6?

Answer:

AAAA

AAAA

Which DNS record type refers to the email server?

Answer:

MX

MX

Task 3: WHOIS

Before a domain name can resolve to IP addresses via DNS, it must be registered with a recognized domain registrar. WHOIS is a public query and response protocol used to lookup registration records and verify administrative ownership details for registered domains.

Domain Ownership and Privacy

A standard WHOIS record contains critical domain administrative details, including the registrar name, creation date, expiration date, last update timestamp, and registrant contact details (name, email, phone number, and physical address). While WHOIS databases were originally entirely public, many domain owners now use privacy services (such as Domains By Proxy) to redact personal contact details from public record searches.

Guided Walkthrough: Querying WHOIS via the Command Line

Linux environments include the native whois client to query domain registration databases directly from the terminal.

To query the creation date for x.com, we execute whois x.com in the terminal. Inspecting the Creation Date attribute reveals that the domain was originally registered on 1993–04–02.

Similarly, executing whois twitter.com queries the respective registry database and highlights a registration Creation Date of 2000–01–21.

Questions and Answers

When was the x.com record created? Provide the answer in YYYY-MM-DD format.

Answer:

1993–04–02

1993–04–02

When was the twitter.com record created? Provide the answer in YYYY-MM-DD format.

Answer:

2000-01-21

2000-01-21

Task 4: HTTP(S): Accessing the Web

When navigating web pages using a web browser, communications rely heavily on the Hypertext Transfer Protocol (HTTP) and its encrypted variant, HTTPS. Operating over TCP port 80 (HTTP) and TCP port 443 (HTTPS), these Application Layer protocols define standard request and response interactions between web clients (browsers) and web servers.

Core HTTP Request Methods

Browsers send specific HTTP methods to inform the server of the requested action:

• GET: Requests and retrieves data or resources (such as HTML documents or images) from the server.
• POST: Submits new data to the server, commonly used when filling out web forms or uploading files.
• PUT: Uploads or creates a specified resource on the server, overwriting existing target data.
• DELETE: Requests the removal of a specified file or resource from the web server.

Guided Walkthrough: Interacting with HTTP via Telnet

Because standard HTTP requests consist of plain text, administrators can interact directly with web servers without using a traditional browser. By opening a raw TCP connection over port 80 using telnet, you can manually formulate HTTP headers to test server responses directly.

To access the file flag.html on the target machine, initiate a connection via telnet MACHINE_IP 80. Once connected, issue the following HTTP request headers followed by a blank line:

GET /flag.html HTTP/1.1
Host: anything

GET /flag.html HTTP/1.1
Host: anything

The web server processes the request and returns an HTTP/1.1 200 OK response along with the raw HTML payload, revealing the hidden flag embedded within a <div class="hidden-text"> element.

Questions and Answers

Use telnet to access the file flag.html on MACHINE_IP. What is the hidden flag?

Answer:

THM{TELNET-HTTP}

THM{TELNET-HTTP}

Task 5: FTP: Transferring Files

While HTTP is designed primarily for fetching web page content, the File Transfer Protocol (FTP) is optimized specifically for reliable file upload and download operations. Operating over TCP port 21 for control commands, FTP coordinates file transfers over a separate dedicated data connection.

Core FTP Commands

Clients interact with FTP servers using raw protocol instructions:

• USER: Identifies and submits the account username to the server.
• PASS: Submits the password corresponding to the specified user.
• RETR: Instructs the server to transfer a copy of a file from the server to the client.
• STOR: Uploads and stores a local file on the remote server.

Interacting with FTP via the Command Line

To connect to a target FTP server, administrators utilize the standard command-line ftp client. Many public or testing FTP services enable anonymous authentication, allowing users to log in without specific account credentials.

Connecting to the target host via ftp MACHINE_IP prompts for a login identity. Entering anonymous as the username and leaving the password blank grants immediate access. Running ls lists available directory files (coffee.txt, flag.txt, and tea.txt). Issuing get flag.txt directly initiates data transfer in binary mode, retrieving the target file to the local working directory.

After closing the session with exit, executing cat flag.txt on the local system prints the retrieved flag contents.

Questions and Answers

Using the FTP client ftp on the AttackBox, access the FTP server at MACHINE_IP and retrieve flag.txt. What is the flag found?

Answer:

THM{FAST-FTP}

THM{FAST-FTP}

Task 6: SMTP: Sending Email

While browsing web pages and transferring files rely on HTTP and FTP, sending electronic mail requires its own dedicated transmission standard. The Simple Mail Transfer Protocol (SMTP) governs how email clients communicate with outgoing mail servers and how intermediate mail servers relay messages across the Internet to their final destinations. Operating over TCP port 25 by default, SMTP acts much like a physical post office, establishing sender identity and recipient addresses before accepting a payload for delivery.

Mail Protocol Commands and Mechanics

An SMTP transaction begins when a client initiates a session by sending a HELO or EHLO handshake command to the mail server. Once acknowledged, the client defines the sender's address using the MAIL FROM: command, followed by the target recipient's address using RCPT TO:. To transition from setting metadata to transmitting the actual email content, the client issues the DATA command. The server responds with an instruction to begin typing, and the client signals the end of the message body by transmitting a single period (.) on an empty line.

Testing Mail Delivery via Telnet

Because SMTP relies on plain-text exchanges, administrators often troubleshoot mail delivery issues manually by connecting directly to TCP port 25 using telnet. Executing telnet MACHINE_IP 25 opens an interactive session where commands like HELO, MAIL FROM:, RCPT TO:, and DATA can be typed sequentially. This raw interaction exposes the underlying server response codes, such as 250 OK or 354 Enter message, demonstrating exactly how mail clients formulate and deliver email messages under the hood.

Questions and Answers

Which SMTP command indicates that the client will start the contents of the email message?

Answer:

DATA

DATA

What does the email client send to indicate that the email message has been fully entered?

Answer:

.

.

Task 7: POP3: Receiving Email

While SMTP handles sending messages, clients require a dedicated protocol to check and download incoming mail from a server mailbox. The Post Office Protocol version 3 (POP3) enables email clients to connect to a remote mail server, authenticate, retrieve stored messages, and download them locally.

A helpful analogy is thinking of SMTP as dropping a letter into a public post box and POP3 as opening your local personal mailbox with a key to collect accumulated mail.

Core POP3 Commands

POP3 operates over TCP port 110 by default and utilizes plain-text commands for authentication and mailbox management:

• USER: Provides the username for account authentication.
• PASS: Submits the password corresponding to the specified account.
• STAT: Queries the mailbox for the total count and cumulative size of stored messages.
• LIST: Displays a list of message numbers alongside their respective byte sizes.
• RETR: Retrieves the full headers and body of a specific message by its index number.
• DELE: Flags a designated message for deletion upon session close.
• QUIT: Ends the POP3 session and commits marked changes or deletions.

Interacting with POP3 via Telnet

Because POP3 transfers plain text, users can authenticate and inspect mailboxes manually over TCP port 110 using telnet.

Connecting via telnet MACHINE_IP 110 triggers an initial server banner response identifying the service as Dovecot (Ubuntu). Authenticating with USER linda and PASS Pa$$123 unlocks access to the mailbox. Executing STAT shows 4 total messages, while LIST lists each message index along with its length in octets.

To view the contents of the fourth email, execute RETR 4. The POP3 server streams the complete email headers and message body, revealing the subject line Your Flag along with the flag value embedded directly inside the message text.

Questions and Answers

Looking at the traffic exchange, what is the name of the POP3 server running on the remote server?

Answer:

Dovecot

Dovecot

Use telnet to connect to MACHINE_IP's POP3 server. What is the flag contained in the fourth message?

Answer:

THM{TELNET_RETR_EMAIL}

THM{TELNET_RETR_EMAIL}

Task 8: IMAP: Synchronizing Email

While POP3 works well when managing email from a single device, accessing a mailbox across multiple clients — such as a smartphone, laptop, and desktop — requires mailbox state synchronization. The Internet Message Access Protocol (IMAP) addresses this by keeping messages stored centrally on the server while reflecting folder state, read status, and message deletions seamlessly across all connected clients.

Core IMAP Commands and Syntax

IMAP operates over TCP port 143 by default. Unlike POP3, IMAP requires each client command to be prefixed with a unique alphanumeric tag (such as A, B, or C) to track asynchronous responses:

• LOGIN: Authenticates the user session with a username and password (e.g., A LOGIN user pass).
• SELECT: Opens a specific mailbox folder to work with (e.g., B SELECT inbox).
• FETCH: Retrieves specific message attributes or full message bodies (e.g., C FETCH 4 body[]).
• MOVE / COPY: Relocates or duplicates messages between server folders.
• LOGOUT: Ends the active IMAP session (e.g., D LOGOUT).

Interacting with IMAP via Telnet

Because IMAP utilizes plain-text interactions, administrators can connect directly to port 143 using telnet to inspect mailbox contents and test server behavior.

Connecting via telnet MACHINE_IP 143 opens a session with the Dovecot IMAP server. Prefixing commands with custom identifier tags, we authenticate using A LOGIN linda Pa$$123. Once logged in, executing B SELECT inbox selects the main mailbox, returning state information indicating that 4 messages exist within the inbox.

To retrieve and view the fourth email message in its entirety, execute C FETCH 4 body[]. The IMAP server streams the full headers and body text for message index 4, displaying the message details before terminating the session with D LOGOUT.

Questions and Answers

What IMAP command retrieves the fourth email message?

Answer:

FETCH 4 body[]

FETCH 4 body[]

Summary & Key Takeaways

Congratulations on completing Networking Core Protocols! You have now mastered the foundational Application Layer protocols that power web browsing, file transfers, domain lookups, and global email communications.

Throughout this room, we transitioned from basic network-layer concepts to examining the essential protocols operating at the Application Layer (Layer 7). Understanding how DNS translates hostnames, how HTTP and FTP deliver web pages and files, and how SMTP, POP3, and IMAP orchestrate email transmission gives you a complete view of standard internet traffic.

Key lessons:

• Domain Name System (DNS): Maps human-readable hostnames to IP addresses over UDP/TCP port 53 using records like A (IPv4), AAAA (IPv6), CNAME (aliases), and MX (mail servers).
• Domain Registration (WHOIS): Provides public registry information regarding domain ownership, registrar details, and creation/expiration timestamps.
• Web Communication (HTTP/HTTPS): Facilitates web browsing over TCP ports 80 and 443 using key request methods like GET, POST, PUT, and DELETE.
• File Transfer Protocol (FTP): Delivers efficient file uploads (STOR) and downloads (RETR) over TCP port 21, supporting both anonymous and authenticated sessions.
• Mail Transmission & Retrieval (SMTP, POP3, IMAP):
• SMTP (Port 25): Handles outgoing mail transfer between clients and mail servers (HELO, MAIL FROM, RCPT TO, DATA).
• POP3 (Port 110): Downloads stored emails to a single device (USER, PASS, STAT, LIST, RETR).
• IMAP (Port 143): Synchronizes mailboxes across multiple devices using tagged commands (LOGIN, SELECT, FETCH).