Анализ трафика

Platform: bug-makers | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-05-25 | Status: Solved Techniques: flag_format_grep, strings_grep_pcap

Summary

Task: a PCAP capture of normal PC traffic where one request contains a debug message with the flag. Solution: run strings+grep on the PCAP file searching for the flag format to instantly extract the debug log line containing the flag.

Анализ трафика — Bug Makers CTF

Description

С помощью wireshark можно записывать и потом анализировать сетевой трафик. Этим и займемся – записан обычный трафик с ПК, но в одном запросе проскочил дебаг с флагом.

English summary: A PCAP file containing normal PC network traffic is provided. Somewhere in the capture, a debug message with the flag slipped through in one of the requests. The goal is to find this debug message.

File provided: traffic_pc_logs.pcap (589054 bytes, pcap capture file with "No link-layer encapsulation") ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Analysis

The PCAP file contains normal network traffic recorded from a PC. The task description explicitly states that a debug message containing the flag leaked in one of the requests. Since the flag format is known (BugCTF{...}), the simplest approach is to search for it directly in the raw file bytes rather than manually inspecting each packet in Wireshark.

The flag text itself — "I hope you didn't look through each packet" — confirms this was the intended approach: use strings + grep rather than tediously examining packets one by one. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Identify the file

 bash read-only • copy allowed Copy
file traffic_pc_logs.pcap
# pcap capture file - No link-layer encapsulation

Step 2: Extract strings and grep for the flag

 bash read-only • copy allowed Copy
strings traffic_pc_logs.pcap | grep -iE "flag|ctf|debug|BugCTF"

Output:

INFO|DEBUG|BugCTF{REDACTED}

The flag was found in a debug log line formatted as INFO|DEBUG|<flag>, indicating it was a debug-level log message that leaked into the network traffic.

Solve script

 bash read-only • copy allowed Copy
#!/bin/bash
# Solve: extract flag from PCAP using strings + grep
strings traffic_pc_logs.pcap | grep -oE "BugCTF\{[^}]+\}"

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍