- Challenge Overview
Challenge Name: Suspicious Capture
Category: Network Forensics / PCAP Analysis
Platform: Hacklido.com
Objective: Analyze a network packet capture (.pcap) file in Kali Linux to identify suspicious network traffic and recover the hidden flag.
- Investigation Approach
When analyzing unencrypted network packet captures for hidden flags, plain-text streams and HTTP headers are primary targets. The investigation followed these core phases:
File Inspection: Confirming the file format and verifying that plain-text HTTP streams were present in the capture.
String Extraction: Using native Linux terminal utilities to search for structured text patterns directly inside the binary .pcap data.
Pattern Matching & Verification: Isolating strings that match the target flag format (HackCTF{…}).
Evidence/Artifacts Examined
suspicious_capture.pcap: Raw network packet capture containing recorded network traffic.
Tools & Techniques Used
strings Utility: Used to extract printable character sequences from the raw packet capture file.
grep Command: Used to filter the extracted strings for the specific challenge flag wrapper.
- Important Observations
The packet capture contained plain-text HTTP request data.
Custom HTTP headers were transmitted without encryption during client-server communication.
The flag was directly readable in plain text inside the custom HTTP header stream without needing complex protocol parsing.
- Step-by-Step Analysis
Step 1: Navigating to the File Directory
The working directory in Kali Linux was verified to locate the challenge file:
<img width=“1049” height=“552” alt=“Image” src=“https://github.com/user-attachments/assets/fad6ce75-e08b-4d16-9de8-cef19525f3eb” />
Bash
ls -la suspicious_capture.pcap
Step 2: Extracting Printable Strings
The strings command was executed on the .pcap file to convert binary data streams into readable ASCII text:
<img width=“1600” height=“855” alt=“Image” src=“https://github.com/user-attachments/assets/0e97456f-c419-4755-9ef1-529f3bd367b1” />
Bash
strings suspicious_capture.pcap
Step 3: Filtering for the Flag Format
To quickly locate the hidden flag among the extracted text, the output was piped to grep with case-insensitive matching for the HackCTF flag prefix:
Bash
strings suspicious_capture.pcap | grep -i “HackCTF”
How the Flag Was Identified
The combination of strings and grep isolated the custom HTTP header field where the flag was passed in plain text across the network stream.
Final Flag
Plaintext
HackCTF{w1r3_5hark_d3t3ct1v3_77}
<img width=“1600” height=“855” alt=“Image” src=“https://github.com/user-attachments/assets/2c0b0994-56e8-4a6f-8e95-a8679e5d6d93” />
