phake

Overview

We are given a file chall.pcap containing several network transactions. The challenge hint is:

"Something valuable is hidden. Will you discover it?"

Analysis

The file can be opened with Wireshark. Filtering the list of transmissions by http narrows the capture down to the HTTP traffic.

Scrolling through the filtered list, the 90th transmission stands out: a PHP file returns the flag with the content type application/octet-stream. Inspecting that HTTP object reveals the flag in the response body.

Flag

Teknocom{y0u_4ctu4lly_f0und_1t_lol}