A web server posting to a paste site
A web server made an outbound HTTP POST. Use tshark to read the method, host, and body, then decode what it sent and the link the paste site gave back.
Briefing
Web servers answer requests; they rarely start them. The egress sensor saved a capture after web-02 (10.0.90.21) made an outbound connection on port 80.
http.file_data holds the request or response body. Form bodies are URL-encoded: + is a space and %0A is a newline.
sensor-01 · Packet captures
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.