[BASIC] 01 Pcap Cleartext

Category: FORENSICS · Difficulty: BASIC · Points: 100

Background

The brief describes a workstation that was transmitting supervisor credentials over an unsegmented internal network, and the capture was taken before anyone isolated the interface. The traffic is therefore still in cleartext, and the task is to reconstruct the single request that carried the key.

Analysis

The capture is small enough to inspect directly. The protocol hierarchy shows one Ethernet frame carrying one IPv4 packet and one TCP segment, with no retransmissions and no handshake:

frame                frames:1 bytes:137
  eth                frames:1 bytes:137
    ip               frames:1 bytes:137
      tcp            frames:1 bytes:137

The segment runs from 192.168.1.100 on an ephemeral port to 192.168.1.1 on port 80 and is 82 bytes long, which is consistent with an HTTP request line plus a single Host header and nothing else. Because port 80 dissects as HTTP, the payload reads directly out of the file with no stream reassembly required:

$ strings -n 6 traffic-036.pcap
GET /endpoint?token=FLAG{cwa2026_67fb336cf9551c10} HTTP/1.1
Host: cwa.internal

The supervisor key is not in a header, a cookie, or a POST body. It is passed as the value of the token query parameter. Query strings of this kind tend to appear in proxy logs and referrer headers far more often than request bodies do, so a key placed here is exposed in more places than the operator likely intended.

Result

FLAG{cwa2026_67fb336cf9551c10}

The platform accepted the value for challenge 478.