August 9, 2026

📝 INE eJPT — Assessment Methodologies: Footprinting and Scanning CTF 1

A Step-by-Step Reconnaissance Walkthrough

By Namansethi

7 min read

A Step-by-Step Reconnaissance Walkthrough

🔐 Lab: INE eJPT — Assessment Methodologies: Footprinting and Scanning CTF 1 🎯 Focus: Reconnaissance, Service Enumeration, Web Enumeration, Anonymous FTP, MySQL Enumeration 🛠️ Tools: Nmap, FTP, MySQL

Introduction

Reconnaissance is one of the most important phases of a penetration test.

Before attempting to exploit anything, a penetration tester needs to understand the target:

  • What services are running?
  • Which ports are exposed?
  • What technologies are being used?
  • Is sensitive information accidentally exposed?
  • Are there accessible files or directories?
  • Can discovered credentials be reused against another service?

The Assessment Methodologies: Footprinting and Scanning — CTF 1 from INE's eJPT course is designed around exactly this process.

The objective of this challenge was to perform reconnaissance against a target web server and uncover four hidden flags using information exposed through different services.

The challenge provided the following hints:

FlagHint🚩 Flag 1The server announces its identity in every response.🚩 Flag 2The gatekeeper's instructions reveal what should remain unseen.🚩 Flag 3Anonymous access may reveal forgotten files.🚩 Flag 4A well-named database can reveal the final treasure.

The recommended tools were:

  • Nmap
  • FTP
  • MySQL

Let's walk through the complete enumeration process. 🔎

1. Initial Enumeration

The first step was to identify the services exposed by the target.

I performed an Nmap scan using service detection, default NSE scripts, verbose output, and XML output:

nmap -sV -sC -T4 -v target.ine.local -oX nmap.xml

The target resolved to:

target.ine.local (192.27.20.3)

The scan identified several open services:

21/tcp    open    ftp      vsftpd 3.0.5
22/tcp    open    ssh      OpenSSH 8.9p1
25/tcp    open    smtp     Postfix smtpd
80/tcp    open    http     Werkzeug/3.0.6 Python/3.10.12
143/tcp   open    imap     Dovecot imapd
993/tcp   open    imaps    Dovecot imapd
3306/tcp  open    mysql    MySQL 8.0.39

This immediately revealed a fairly broad attack surface.

🔎 Interesting Services

The most interesting services for this particular challenge were:

  • HTTP — 80/tcp
  • FTP — 21/tcp
  • MySQL — 3306/tcp

The Nmap scripts also revealed something particularly interesting about the HTTP service.

🚩 Flag 1 — HTTP Server Header

While enumerating the HTTP service, Nmap inspected the server's HTTP responses.

Among the response information was a custom Server header:

HTTP/1.1 200 OK
Server: Werkzeug/3.0.6 Python/3.10.12
...
Server: FLAG1_d91b01343691427096c1611ac601993a

The unusual value immediately stood out.

The challenge's first hint mentioned that the server "proudly announces its identity in every response."

The Nmap output confirmed that the server was exposing the flag directly through its HTTP response headers.

🚩 Flag 1

FLAG1_d91b01343691427096c1611ac601993a

💡 What I learned

This was a good reminder that reconnaissance isn't limited to discovering ports.

Service metadata and HTTP response headers can also expose sensitive information.

A simple service enumeration scan was enough to reveal the first flag without any exploitation.

📸 Screenshot — Flag 1

[INSERT SCREENSHOT OF THE NMAP OUTPUT SHOWING FLAG 1 HERE]

Figure 1 — Nmap HTTP enumeration revealing the custom Server header containing Flag 1.

🚩 Flag 2 — robots.txt Enumeration

The same Nmap scan provided another useful discovery.

Nmap identified a robots.txt file and reported three disallowed paths:

http-robots.txt: 3 disallowed entries
/photos
/secret-info/
/data/*

The /secret-info/ path immediately looked interesting.

The second challenge hint referred to the "gatekeeper's instructions", which pointed toward robots.txt.

I followed the discovered /secret-info/ directory and found:

/secret-info/flag.txt

Accessing the file revealed the second flag.

🚩 Flag 2

FLAG2_98708d2f82714a9d97f6f5d4894a2c5a

💡 What I learned

robots.txt is intended to provide crawling instructions to search engines, but it should not be treated as a security mechanism.

Disallowed paths can sometimes reveal interesting application locations.

In this challenge, the robots.txt file directly provided a clue toward the location of the second flag.

📸 Screenshot — Flag 2

[INSERT SCREENSHOT OF /secret-info/flag.txt SHOWING FLAG 2 HERE]

Figure 2 — Accessing /secret-info/flag.txt after discovering the directory through robots.txt.

🚩 Flag 3 — Anonymous FTP Access

The Nmap scan had already revealed that FTP was running:

21/tcp open ftp vsftpd 3.0.5

More importantly, Nmap's FTP enumeration reported:

ftp-anon: Anonymous FTP login allowed

This was a significant finding.

The third challenge hint specifically mentioned:

Anonymous access sometimes leads to forgotten treasures.

Based on the Nmap result, I connected to the FTP service:

ftp target.ine.local

The server requested a username, so I attempted an anonymous login:

Name (target.ine.local:root): Anonymous
331 Please specify the password.
Password:
230 Login successful.

The login was successful.

FTP Directory Enumeration

After logging in, I listed the available files:

ftp> dir

The directory contained:

creds.txt
flag.txt

The relevant portion of the listing was:

-rw-r--r--    1 0 0 22 Oct 28  2024 creds.txt
-rw-r--r--    1 0 0 39 Aug 09 08:19 flag.txt

Both files were downloadable.

I retrieved them using:

ftp> get flag.txt
ftp> get creds.txt

The transfers completed successfully.

📸 Screenshot — FTP Enumeration

[INSERT FTP SCREENSHOT SHOWING ANONYMOUS LOGIN + creds.txt + flag.txt HERE]

Figure 3 — Anonymous FTP access and enumeration of the available files.

Retrieving Flag 3

After downloading flag.txt, I read its contents:

cat flag.txt

The file contained:

FLAG3_723824483aa6464884672283973798ad

🚩 Flag 3

FLAG3_723824483aa6464884672283973798ad

But the FTP server had given us something even more interesting.

🔑 Credential Discovery

The second downloaded file was:

creds.txt

Reading it revealed:

cat creds.txt

Output:

db_admin:password@123

These credentials were relevant to the MySQL service identified during the initial Nmap scan.

At this point, the investigation had progressed from:

Nmap
  ↓
FTP
  ↓
Anonymous Access
  ↓
creds.txt
  ↓
MySQL Credentials

The next logical step was to investigate the exposed MySQL service.

📸 Screenshot — Flag 3 & Credentials

[INSERT SCREENSHOT SHOWING cat flag.txt AND cat creds.txt HERE]

Figure 4 — Flag 3 and the database credentials retrieved from the anonymously accessible FTP server.

🚩 Flag 4 — MySQL Enumeration

The Nmap scan had identified MySQL running on:

3306/tcp

with the following version:

MySQL 8.0.39-0ubuntu0.22.04.1

Using the credentials obtained from creds.txt, I connected to the database server:

mysql -h 192.27.20.3 -u db_admin -p

After entering the discovered password, the MySQL session opened successfully.

The server identified itself as:

Server version: 8.0.39-0ubuntu0.22.04.1 (Ubuntu)

Enumerating Databases

Once connected, I enumerated the available databases:

show databases;

The output was:

+--------------------------------------------+
| Database                                   |
+--------------------------------------------+
| FLAG4_5d4ed777155842ad96f8feb29028ac09     |
| information_schema                          |
| mysql                                       |
| performance_schema                           |
| sys                                         |
+--------------------------------------------+

The first database name immediately contained the final flag.

🚩 Flag 4

FLAG4_5d4ed777155842ad96f8feb29028ac09

No further database enumeration was necessary to obtain the final flag.

📸 Screenshot — Flag 4

[INSERT MYSQL SCREENSHOT SHOWING show databases; AND FLAG 4 HERE]

Figure 5 — MySQL database enumeration revealing Flag 4.

🏁 All Flags Collected

After completing the reconnaissance workflow, all four flags had been identified.

FlagDiscovery MethodResult🚩 Flag 1HTTP Server headerFLAG1_d91b01343691427096c1611ac601993a🚩 Flag 2robots.txt → /secret-info/flag.txtFLAG2_98708d2f82714a9d97f6f5d4894a2c5a🚩 Flag 3Anonymous FTP → flag.txtFLAG3_723824483aa6464884672283973798ad🚩 Flag 4MySQL → show databases;FLAG4_5d4ed777155842ad96f8feb29028ac09

🧠 Attack / Enumeration Path

The complete investigation can be summarized as:

Target
  │
  ▼
Nmap Enumeration
  │
  ├── HTTP :80
  │     │
  │     ├── Custom Server Header
  │     │       └── 🚩 Flag 1
  │     │
  │     └── robots.txt
  │             │
  │             └── /secret-info/
  │                     └── flag.txt
  │                             └── 🚩 Flag 2
  │
  ├── FTP :21
  │     │
  │     └── Anonymous Login
  │             │
  │             ├── flag.txt
  │             │     └── 🚩 Flag 3
  │             │
  │             └── creds.txt
  │                   └── MySQL Credentials
  │
  └── MySQL :3306
        │
        └── db_admin Login
                │
                └── show databases;
                        └── 🚩 Flag 4

🔍 What This CTF Actually Taught Me

What made this challenge useful wasn't the complexity of the exploitation.

In fact, there was very little exploitation involved.

The challenge was primarily about recognizing how much information a target can expose during the reconnaissance phase.

The important pattern was:

Enumerate → Observe → Investigate → Correlate → Enumerate Again

The information obtained from one service became useful when investigating another.

For example:

Nmap
 ↓
FTP anonymous access
 ↓
creds.txt
 ↓
MySQL credentials
 ↓
MySQL enumeration
 ↓
Flag 4

This is exactly why comprehensive reconnaissance matters during a penetration test.

📚 Lessons Learned

1. Service enumeration is more than finding open ports

Nmap didn't just tell me which ports were open.

It also exposed:

  • Service versions
  • HTTP response information
  • robots.txt
  • Anonymous FTP access
  • FTP directory contents
  • MySQL version information

The additional enumeration data was what made the next steps possible.

2. HTTP headers can expose sensitive information

The custom HTTP Server header contained Flag 1.

This demonstrated why response headers should be reviewed during web reconnaissance.

3. robots.txt can reveal interesting paths

The robots.txt file exposed /secret-info/.

Even though robots directives aren't an access-control mechanism, they can provide useful reconnaissance information.

4. Anonymous FTP access deserves attention

The FTP service allowed anonymous authentication.

That access exposed:

flag.txt
creds.txt

The second file was particularly important because it contained credentials for another service.

5. Information discovered on one service can unlock another

This was probably the most valuable lesson from the CTF.

The credentials discovered through FTP were not the final objective.

They became the input for the next stage:

FTP Credentials
      ↓
MySQL Authentication
      ↓
Database Enumeration
      ↓
Flag 4

This demonstrates the importance of correlating findings across services rather than treating each service as an isolated target.

🛠️ Tools Used

Nmap

Used for initial reconnaissance and service enumeration.

nmap -sV -sC -T4 -v target.ine.local -oX nmap.xml

Key capabilities used during this challenge included:

  • Service/version detection
  • Default NSE scripts
  • HTTP enumeration
  • FTP enumeration
  • General service discovery

FTP

Used to access the FTP service after Nmap identified that anonymous authentication was allowed.

ftp target.ine.local

Files retrieved:

flag.txt
creds.txt

MySQL Client

Used to authenticate to the exposed MySQL service using credentials discovered through FTP.

mysql -h 192.27.20.3 -u db_admin -p

Database enumeration:

show databases;

🧾 Cheatsheet

Nmap

nmap -sV -sC -T4 -v target.ine.local -oX nmap.xml

FTP

ftp target.ine.local
Anonymous
dir
get flag.txt
get creds.txt

Read downloaded files

cat flag.txt
cat creds.txt

MySQL

mysql -h 192.27.20.3 -u db_admin -p
show databases;

💬 Interview Questions

1. Why is service enumeration important?

Because knowing which services and versions are exposed helps a penetration tester understand the target's attack surface and determine where further investigation should be focused.

2. Why is robots.txt interesting during reconnaissance?

It can reveal paths that the website administrator does not want crawlers to index. These paths may still be publicly accessible and can provide useful reconnaissance information.

3. Why is anonymous FTP access significant?

Anonymous FTP can unintentionally expose files and information without requiring authenticated user credentials.

4. What was the significance of creds.txt?

It contained database credentials that enabled authentication to the MySQL service identified during the initial scan.

5. Why is correlation between services important?

A finding from one service can provide information required to investigate another service. In this CTF, FTP exposed MySQL credentials, which then enabled database enumeration.

6. Was exploitation required to complete this CTF?

The documented solution primarily relied on reconnaissance and enumeration rather than a traditional vulnerability exploitation chain.

🎯 Personal Reflection

What I Learned

This CTF reinforced the importance of thorough reconnaissance.

The biggest takeaway was that seemingly small pieces of information — such as an HTTP header, a robots.txt entry, anonymous FTP access, or a configuration file—can eventually form a complete attack path.

Biggest Challenge

The challenge was less about exploiting a vulnerability and more about correctly interpreting the information revealed during enumeration and deciding what to investigate next.

Most Valuable Lesson

Don't stop at the first useful finding.

A service may reveal information that becomes useful somewhere else in the target.

What I Would Do Differently Next Time

I would continue approaching reconnaissance systematically:

Identify Services
      ↓
Enumerate Each Service
      ↓
Record Interesting Information
      ↓
Correlate Findings
      ↓
Investigate New Leads
      ↓
Verify Results

This makes the process more structured and reduces the chance of overlooking useful information.

🏆 Conclusion

The INE eJPT Assessment Methodologies: Footprinting and Scanning CTF 1 was a great exercise in understanding the value of reconnaissance.

The complete solution required following information across multiple services:

HTTP
 ↓
robots.txt
 ↓
FTP
 ↓
Credentials
 ↓
MySQL

The four flags were not hidden behind a complicated exploit chain. Instead, they were exposed through different pieces of information available during enumeration.

The biggest lesson I took from the challenge is simple:

Good penetration testing starts with good reconnaissance.

The more accurately the attack surface is mapped, the easier it becomes to identify meaningful paths forward.

And sometimes, the information needed to reach the next stage is already sitting in the output of the previous command. 🔎💻

🏷️ Tags

#eJPT #INE #CyberSecurity #PenetrationTesting #Reconnaissance #Footprinting #Nmap #FTP #MySQL #Enumeration #CTF #EthicalHacking