HackBlue

Tools · CTF categories for beginners · 07 / 18

CTF network forensics: finding flags in packet captures with Wireshark and tshark

Approach a challenge pcap systematically: protocol hierarchy, conversations, follow streams, export transferred files, and search for credentials or encoded data.

10 min read · practice only with authorization

Start with an overview

Open Statistics, then Protocol Hierarchy, to see which protocols are present. Then Statistics, Conversations, to see who talked to whom and how much. Large or unusual conversations are usually where the challenge lives.

Dig in

Follow TCP or HTTP streams to read the conversation as text. File, Export Objects, HTTP or SMB extracts transferred files. Clear-text protocols like FTP, Telnet, and HTTP basic auth expose credentials in practice captures. DNS queries sometimes carry data in subdomains. Search packet bytes for the flag prefix with a display filter such as frame contains "flag".

Snippet
tshark -r challenge.pcap -q -z io,phs
tshark -r challenge.pcap -q -z conv,tcp
tshark -r challenge.pcap -Y 'frame contains "flag"' -T fields -e frame.number -e ip.src -e ip.dst
tshark -r challenge.pcap -q -z follow,tcp,ascii,0 | head -50
tshark -r challenge.pcap --export-objects http,./exported
tshark -r challenge.pcap -Y dns.qry.name -T fields -e dns.qry.name | sort -u

Lab: make your own capture

On your lab VM, start a capture on the loopback interface, run a simple HTTP server with python3 -m http.server, download a file containing a practice flag with curl, and stop the capture. Then solve it: find the request in the HTTP conversation, export the file, and locate the flag. Repeat with the file base64-encoded inside a DNS query name you craft with dig against a local resolver.

Snippet
sudo tshark -i lo -w practice.pcap &
echo 'flag{pcap_practice}' > f.txt && python3 -m http.server 8000 &
curl -s http://127.0.0.1:8000/f.txt
sudo pkill tshark; kill %2
tshark -r practice.pcap -Y http.request -T fields -e http.request.uri

Tips

Check for TLS key log files provided with the challenge, which let Wireshark decrypt traffic through the TLS protocol preferences. Look at timing and packet sizes when content seems empty; data can be encoded in lengths or intervals. Keep notes of frame numbers so you can return to evidence quickly.

Diagram

Pcap challenge approach

  1. Overview

    Protocol hierarchy and conversations.

  2. Search

    frame contains "flag", credentials, odd DNS names.

  3. Follow and export

    Follow streams; export HTTP or SMB objects.

  4. Decode

    Decode any encoded payloads you find.

Check yourself

1. Which Wireshark statistic shows which protocols appear in a capture?

2. How do you extract a file downloaded over HTTP in a capture?

3. Which display filter searches raw packet bytes for a string?