Простой API-сервер

Platform: duckerz | Category: Forensics | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: traffic_analysis, http_parameter_extraction, url_decoding

Summary

Files: simple_api.pcapng (82 MB)

Простой API-сервер — duckerz CTF

Description

"Наш сайт решили заддосить, хорошо, что он устойчив, идентифицируйте хакера!"

(Translation: "Our site was DDoSed, good thing it's resilient, identify the hacker!")

Files: simple_api.pcapng (82 MB)

Analysis

Initial Examination

Received a large pcapng file (82 MB) with network traffic spanning ~22 minutes.

 bash read-only • copy allowed Copy
# Download the file
curl -sL -o simple_api.pcapng "https://download.tasks.duckerz.ru/SimpleApi/simple_api.pcapng"

# Analyze IP conversations
tshark -r simple_api.pcapng -q -z conv,ip

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Traffic Statistics

Main traffic between two hosts:

• 192.168.100.111 — attacker
• 192.168.100.100:25003 — target API server

Found over 1000 HTTP requests with User-Agent: python-requests/2.25.1

DDoS Attack Pattern

Most requests are flood on API endpoints:

• /api/get_reviews
• /api/get_top_slider
• /api/get_bottom_slider
• /api/get_prices
• /api/get_video
• /api/image/slider5.png

Key Finding

Among the mass of DDoS requests, a login request was discovered:

GET /api/login?username=hacker&password=DUCKERZ%7BREDACTED%7D HTTP/1.1
Host: 192.168.100.100:25003

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The password is transmitted in URL-encoded format!

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# Extract unique HTTP URIs from pcap
tshark -r simple_api.pcapng -Y "http" -T fields -e http.request.full_uri | sort -u

# Search for login requests
tshark -r simple_api.pcapng -Y "http.request.uri contains \"login\"" -T fields -e http.request.full_uri

# URL-decode the password
python3 -c "import urllib.parse; print(urllib.parse.unquote('DUCKERZ%7BREDACTED%7D'))"

URL Decoding

Result: DUCKERZ{REDACTED}

Lessons

1. Always check ALL HTTP requests — not just frequent ones, but unique ones too
2. Credentials in URL — attackers sometimes pass passwords via GET parameters
3. DDoS as camouflage — flood can hide other malicious activity
4. URL-encoding — don't forget to decode parameters

Useful tshark Commands

 bash read-only • copy allowed Copy
# IP statistics
tshark -r file.pcapng -q -z conv,ip

# All HTTP requests
tshark -r file.pcapng -Y "http.request" -T fields -e http.request.full_uri
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

# Filter by URI content
tshark -r file.pcapng -Y "http.request.uri contains \"keyword\""

# HTTP with credentials
tshark -r file.pcapng -Y "http.request.uri contains \"login\" or http.request.uri contains \"password\""

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍