CTF TOPIC · 8 FLAGS · 20 MIN

Network evidence

Reading HTTP by hand, DNS TXT records and following a TCP stream.

Network challenges give you captured traffic. Plain HTTP and FTP send everything as readable text, including custom headers, which is why sites use TLS. DNS TXT records can hold arbitrary strings and sometimes leak notes. A packet capture (pcap) can be reassembled into the client-server conversation; Wireshark's Follow TCP Stream does exactly this. Read the exchange and the flag is usually in plain sight.

A first example

dig TXT domain ; GET /path HTTP/1.1 headers ; Follow TCP Stream in Wireshark

First moves

1. Identify protocols and ports
2. Follow the TCP stream of interesting conversations
3. Read headers, form bodies and cookies
4. Check DNS records, especially TXT
5. Decode anything that looks encoded

The challenges

• A message in a request · Easy · 20 XP
• TXT pieces · Easy · 20 XP
• Reassemble the stream · Medium · 30 XP
• Read the request · Easy · 20 XP
• Ask DNS · Easy · 20 XP
• Follow the stream · Medium · 30 XP
• Read the port scan · Easy · 20 XP
• What was submitted? · Medium · 30 XP