← Back to HWJ CTF

MACHINE BOUND NETWORK CLUES

Extract host-bound secret payload from network PCAP packet capture.

Tools Used

tsharkWiresharkNetwork Analysis

Overview

The secret token is bound to local host identifiers (hostname, MAC, loopback API). We analyze network traffic to reconstruct the exchanged payload.

Reconnaissance

Inspect network streams using tshark filtering frame fields and IP addresses.

Exploitation Strategy

Trace suspicious loopback stream exchanges to recover the plain text flag.

Solution Code

tshark -r net_capture.pcapng -T fields -e frame.number -e ip.src -e ip.dst -e tcp.srcport -e tcp.dstport
# Recovered payload: hwj{n37w0rk_5ucc35fully_1n5p3c73d}

Flag

hwj{n37w0rk_5ucc35fully_1n5p3c73d}