Hack The Box Meetup: Crocodile and Sequel with Kagiso Setwaba

🐊 Workshop 1: Crocodile (Starting Point - Linux)
Welcome to our session on Crocodile, a beginner-friendly Linux machine focusing on service enumeration, identifying cleartext credential exposures, and navigating web admin interfaces.
🎯 What to Expect
In this session, we will explore how minor configuration oversights on public-facing services can lead to complete administrative compromise:

• Anonymous FTP Enumeration: Discovering unauthenticated file access and downloading sensitive backup files containing plaintext credentials.
• Directory & Subdomain Fuzzing: Using web enumeration techniques to locate hidden login portals and administration endpoints.
• Authentication Bypass: Utilizing recovered credentials to access the admin portal and understand data exposure risks.

📅 Workshop Agenda

| Time | Activity | Description |
| ---- | -------- | ----------- |
| 00:00 – 00:15 | Welcome & Setup | Connect to the HTB VPN, verify connectivity, and target ping test. |
| 00:15 – 00:45 | FTP Enumeration | Scan ports, connect via anonymous FTP, and inspect retrieved files. |
| 00:45 – 01:15 | Web Fuzzing | Discovering hidden web paths/endpoints using directory brute-forcing. |
| 01:15 – 01:45 | Admin Access | Logging into the administrative panel with extracted cleartext credentials. |
| 01:45 – 02:00 | Remediation & Q&A | Discussing secure FTP configs, access controls, and session wrap-up. |

🗄️ Workshop 2: Sequel (Starting Point - Linux)
Our second lab session covers Sequel, a Linux host demonstrating the critical risks of database services exposed to the network without authentication controls.
🎯 What to Expect
This lab provides a foundational look at database security and direct SQL interaction:

• Database Service Discovery: Identifying default port configurations for database services exposed on external interfaces.
• Unauthenticated Access: Connecting directly to MySQL without a password due to misconfigured access rules.
• SQL Data Extraction: Executing basic SQL queries (SHOW DATABASES, SELECT, etc.) to map out tables, inspect structures, and dump sensitive information.

📅 Workshop Agenda

| Time | Activity | Description |
| ---- | -------- | ----------- |
| 00:00 – 00:15 | Overview & Connectivity | Brief recap of network port scanning and setting up the lab environment. |
| 00:15 – 00:45 | Service Identification | Running Nmap targeting database ports and analyzing service responses. |
| 00:45 – 01:15 | Database Enumeration | Connecting via the native client and enumerating schemas and tables. |
| 01:15 – 01:45 | Data Querying & Analysis | Formulating targeted SQL statements to extract key flags and administrative data. |
| 01:45 – 02:00 | Hardening & Q&A | Reviewing MySQL configuration files (my.cnf), binding IPs, and password enforcement. |

🎒 What You Need to Bring

• Laptop: Charged laptop running Windows (with WSL), Linux, or macOS.
• Hack The Box Account: Free account ready to spawn lab targets.
• VPN Client: OpenVPN installed with your HTB connection file ready, or access via HTB Pwnbox.
• Basic Tooling: Default Linux utilities (nmap, ftp, mysql-client, gobuster/ffuf) pre-installed.