Skip to main content
  1. CTF Writeups/

PcapPoisoning - picoGym

·115 words·1 min
picoGym General Skills Wireshark
Miles Handelman
Author
Miles Handelman

Link to challenge

This challenge gives us a .pcap file with the description telling us that the flag is hiding inside of it. Just like in the Eavesdrop challenge, I started out by opening the pcap file in Wireshark to a very ugly sight: 1510 packets of mostly FTP and TCP data.

FTPCAP

My intuition for this challenge was to search the frame for picoCTF in case the flag is written in plaintext within one of the packets, so I used the filter: frame contains "picoCTF" to check for this.

frameContains

With this result, I found the flag in plaintext located within the binary of the packet, which after some light formatting would reveal the flag: picoCTF{P64P_4N4L7S1S_SU55355FUL_31010c46}

Related

Based - picoGym
·127 words·1 min
picoGym General Skills Python ChatGPT
Eavesdrop - picoGym
·182 words·1 min
picoGym Forensics Wireshark
Serpentine - picoGym
·132 words·1 min
picoGym General Skills Python
Matryoshka Doll - picoGym
·106 words·1 min
picoGym Forensics Steganography
St3g0 - picoGym
·73 words·1 min
picoGym Forensics Steganography
hideme - picoGym
·94 words·1 min
picoGym Forensics Steganography