Protocol Analysis 1: Can You Hear Me?

Platform: CUSTOM | Category: Misc | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: plaintext_message_forwarding, protocol_relay, unauthenticated_protocol_abuse

Summary

Walkthrough of the CUSTOM Misc Protocol Analysis 1: Can You Hear Me?. Task: a protocol manual describes a simple Alice/Bob exchange where Alice asks Bob for the flag and both sides receive exact plaintext messages. Solution: create a session, relay Alice's first message

Description

Alice sends: "Hello", B, "this is", A, "give me the flag" Bob receives the exact same message Bob sends: "here it is", [FLAG] Alice receives the exact same message

English summary: the challenge provides a simple scripted protocol and a live service. The protocol is completely plaintext and unauthenticated, so the attacker can just relay Alice's request to Bob and read the flag from Bob's reply.

Analysis

The PDF manual for challenge 1 already gives away the core weakness: there is no cryptography, no authentication, and no message integrity. The only required behavior is that Bob receives the exact message Alice sent, and Alice then receives Bob's exact response.

After creating a protocol instance on https://protocols.live/model/1, sending an empty message to Alice returns her first scripted payload:

 text read-only • copy allowed Copy
t:Hello|n:bob|t:this is|n:alice|t:give me the flag

This format is still plaintext; it is just tokenized. Since the service lets us relay arbitrary content between the endpoints, we do not need to break anything. We only need to forward Alice's message to Bob unchanged.

Bob then responds with the flag in the same plaintext format:

 text read-only • copy allowed Copy
t:here it is|t:DawgCTF{REDACTED}

So the vulnerability is a trivial relay attack against an unauthenticated plaintext protocol.

Solution

1. Open https://protocols.live/model/1 and create a new protocol instance.
2. Record the returned conn_id.
3. Send an empty content value to the /alice endpoint to retrieve Alice's scripted first message.
4. Copy that exact response body and submit it to the /bob endpoint.
5. Read Bob's reply; it directly contains the flag.

Example interaction:

 text read-only • copy allowed Copy
Alice -> t:Hello|n:bob|t:this is|n:alice|t:give me the flag
Bob   -> t:here it is|t:DawgCTF{REDACTED}

 python read-only • copy allowed Copy
#!/usr/bin/env python3

import requests

BASE = "https://protocols.live"


def main():
    session = requests.Session()

    # Create a fresh instance from model 1.
    create = session.post(f"{BASE}/model/1")
    create.raise_for_status()
    data = create.json()
    conn_id = data["conn_id"]

    # Ask Alice for her first scripted message.
    alice = session.post(
        f"{BASE}/alice",
        json={"conn_id": conn_id, "content": ""},
    )
    alice.raise_for_status()
    alice_msg = alice.json()["content"]
    print(f"Alice says: {alice_msg}")

    # Relay Alice's exact plaintext to Bob.
    bob = session.post(
        f"{BASE}/bob",
        json={"conn_id": conn_id, "content": alice_msg},
    )
    bob.raise_for_status()
    bob_msg = bob.json()["content"]
    print(f"Bob says:   {bob_msg}")


if __name__ == "__main__":
    main()

The output includes the flag:

 text read-only • copy allowed Copy
t:here it is|t:DawgCTF{REDACTED}

Key Takeaways / Lessons

• Mastering plaintext_message_forwarding, protocol_relay, unauthenticated_protocol_abuse was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-10 • CUSTOM • Protocol Analysis 1: Can You Hear Me? • Difficulty: Easy