Трафик (Traffic)

Platform: hackerlab.pro | Category: Misc | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-24 | Status: Solved Techniques: PCAP file analysis, HTTP traffic inspection, GET parameter extraction, Sensitive data discovery in request parameters

Summary

The archive task.zip contains a task.pcap file with network traffic.

Трафик (Traffic) - hackerlab.pro

Description

"Кажется кто-то пытался взломать наш API..." (Looks like someone tried to hack our API...)

The archive task.zip contains a task.pcap file with network traffic.

Analysis

Examining the PCAP File

 bash read-only • copy allowed Copy
$ unzip task.zip
Archive:  task.zip
  inflating: task.pcap

$ file task.pcap
task.pcap: pcap capture file, microsecond ts (little-endian) - version 2.4

$ capinfos task.pcap
File name:           task.pcap
File type:           Wireshark/tcpdump/... - pcap
Number of packets:   XXX

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

HTTP Traffic Analysis

Using tshark to extract HTTP requests:

 bash read-only • copy allowed Copy
# Show all HTTP requests
$ tshark -r task.pcap -Y "http.request" -T fields -e http.request.uri

# Search for parameters with suspicious names
$ tshark -r task.pcap -Y "http.request" -T fields -e http.request.full_uri | grep -i secret

Flag Discovery

The traffic contains requests to the API endpoint /stats/1 with a secret parameter:

GET /stats/1?secret=test123
GET /stats/1?secret=admin
GET /stats/1?secret=password
GET /stats/1?secret=CODEBY{REDACTED}
GET /stats/1?secret=flag
...

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The attacker was brute-forcing various values for the secret parameter, and one of the tested values turned out to be the flag itself.

Solution

Method 1: tshark with Filtering

 bash read-only • copy allowed Copy
# Extract all URIs with secret parameter
tshark -r task.pcap -Y "http.request.uri contains secret" -T fields -e http.request.uri

# Or search for flag format directly
tshark -r task.pcap -Y "http" -T fields -e http.request.uri | grep -i "CODEBY"

Method 2: strings + grep

 bash read-only • copy allowed Copy
# Quick flag search in raw dump
strings task.pcap | grep -i "CODEBY"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Method 3: Wireshark GUI

1. Open task.pcap in Wireshark
2. Filter: http.request.uri contains "secret"
3. Review HTTP requests in the details panel
4. Find the request with the flag in the parameter

Method 4: Python + scapy

 python read-only • copy allowed Copy
#!/usr/bin/env python3
from scapy.all import rdpcap, TCP, Raw
import re

packets = rdpcap('task.pcap')

for pkt in packets:
    if pkt.haslayer(Raw):
        payload = pkt[Raw].load.decode('utf-8', errors='ignore')
        # Search for flag format
        match = re.search(r'CODEBY\{[^}]+\}', payload)
        if match:
            print(f"Found flag: {match.group()}")
            break

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Task Hints

• "Tried to hack our API" — indicates HTTP/API traffic
• "Traffic" — direct hint at network dump (PCAP)
• Flag "REDACTED" (flag from pcap) — confirms the source

Typical Places to Search for Flags in PCAP

1. GET parameters: ?secret=FLAG&key=value
2. POST data: form or JSON in request body
3. HTTP headers: Authorization, X-Flag, custom headers
4. Cookie: session=FLAG; token=value
5. Response body: HTML, JSON, plaintext responses
6. DNS queries: flag.example.com
7. FTP/Telnet: plaintext credentials and data ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Useful tshark Commands

 bash read-only • copy allowed Copy
# All HTTP requests
tshark -r file.pcap -Y "http.request" -T fields -e http.request.full_uri

# POST data
tshark -r file.pcap -Y "http.request.method==POST" -T fields -e http.file_data

# HTTP headers
tshark -r file.pcap -Y "http" -T fields -e http.host -e http.request.uri -e http.cookie

# Follow HTTP stream
tshark -r file.pcap -z "follow,http,ascii,0"

# Export HTTP objects
tshark -r file.pcap --export-objects http,./exported/

API Security

This task demonstrates the following issues:

1. Sensitive data in URL — secrets should not be passed in GET parameters (they get logged)
2. No rate limiting — attacker was able to brute-force many values
3. Predictable parameter names — secret is easy to guess
4. Logging sensitive data — traffic was captured and saved ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍