CTF PCAP Walkthrough: see-through.pcapng Flag
Oliver Ripka
Introduction to CTF and pcap Analysis
Capture-the-flag (CTF) challenges are popular in the cybersecurity world, as they test participants' skills in various security-related tasks. One common challenge involves analyzing pcap (packet capture) files to find hidden flags. In this article, we'll analyze see-through.pcapng, a CTF challenge pcap file, and show you how to find the flag using PacketSafari and Wireshark.
Finding the Flag with PacketSafari
To start, let's open see-through.pcapng in the PacketSafari online PCAP analyzer and begin our analysis. To find the flag, we'll filter for all initial SYN packets using the following display filter:
tcp.flags.syn == 1 and tcp.flags.ack == 0
After applying the filter, right-click on the fourth packet (packet 35) in the list and select "Follow->TCP".
Scroll down through the contents of the TCP stream, and you'll find the flag hidden among the data.
Alternative way
Instead of following the TCP stream this time, you can also look for the flag in the packet list directly. Go to the lower-right corner of Wireshark and select packet 83. Examine the hex view, and you'll see the flag in plain sight.
Additional Tips and Tricks
When analyzing pcap files for CTF challenges, it's important to be familiar with various Wireshark filters and techniques, as these can significantly speed up the process. In our example, knowing how to filter for initial SYN packets helped us find the flag quickly. Additionally, being comfortable with both PacketSafari and Wireshark can provide extra flexibility and options when tackling challenges.
Conclusion and Further Learning
In this article, we've demonstrated how to find a hidden flag in the see-through.pcapng CTF challenge using both PacketSafari and Wireshark. By applying the right filters and examining packet contents, we were able to locate the flag quickly and efficiently.
To further improve your packet analysis skills, practice the techniques above against additional real-world captures and validate each conclusion against packet evidence.