Learn packet analysis with challenging Wireshark labs (+25 advanced PCAP case-studies) !
LabLab Platform
Info·

CTF and Creative PCAP Challenges: A Walkthrough of 5 Unique Cases

Oliver Ripka Oliver Ripka

Introduction to CTF and Creative PCAP Challenges

Capture the Flag (CTF) competitions are popular cybersecurity events where participants solve challenges across various categories, such as web exploitation, cryptography, and packet analysis, to gain flags. These flags, usually strings of text, can be submitted for points. Creative PCAP challenges, on the other hand, involve analyzing packet capture files to find hidden information or solve puzzles. Both types of challenges provide excellent opportunities to test and improve your packet analysis skills.

Hey! Are you interested in CTFs and Wireshark? We’ve released a brand-new Wireshark lab called Ranger. It includes 25+ case studies and challenges. Check it out!

In this article, we will walk through five unique CTF and creative PCAP challenges, discuss expert insights, and provide Wireshark tips and tricks to help you master these challenges.

Case Study 1: Hidden Messages in ICMP Echo Requests

In this challenge, a PCAP file contains ICMP echo requests and replies. The goal is to identify a hidden message within the ICMP data.

Wireshark Tip: Use the display filter icmp.type == 8 to display only ICMP echo requests. Examine the ICMP data section for any ASCII characters that form a message.

Case Study 2: HTTP File Transfer Reconstruction

An HTTP file transfer has occurred, and the objective is to reconstruct the transferred file from the captured packets.

Wireshark Tip: Use the display filter http.request or http.response to show only HTTP requests and responses. Then, right-click on a packet and select "Follow > HTTP Stream" to see the transferred file content. Save the content and reconstruct the file.

Case Study 3: Uncovering a Covert DNS Tunnel

A PCAP file contains DNS traffic, and the challenge is to identify any covert communication hidden within the DNS queries and responses.

Wireshark Tip: Apply the display filter dns.qry.type == 1 to show only DNS A record queries. Look for unusual domain names or patterns in the queries and responses that may indicate covert communication.

Case Study 4: Decrypting SSL/TLS Traffic

In this challenge, you are given a PCAP file with encrypted SSL/TLS traffic and a private key. The goal is to decrypt the traffic and find a hidden message.

Wireshark Tip: Go to "Edit > Preferences > Protocols > SSL" and add the private key to the RSA keys list. Apply the display filter ssl.handshake to verify that the decryption is successful. Look for any application data containing the hidden message.

Case Study 5: Identifying Rogue DHCP Servers

In this challenge, a PCAP file contains DHCP traffic, and the goal is to identify any rogue DHCP servers that are offering unauthorized IP addresses to clients.

Wireshark Tip: Use the display filter dhcp to show only DHCP packets. Carefully examine the "DHCP Offer" packets and their source IP addresses. Check if any IP addresses do not belong to the authorized DHCP servers to identify rogue servers.

Case Study 6: Uncovering FTP Credentials and File Transfers

A PCAP file contains FTP traffic, and the challenge is to find the usernames, passwords, and details of any file transfers that occurred.

Wireshark Tip: Apply the display filter ftp to display only FTP packets. Look for packets containing the "USER" and "PASS" commands to retrieve the usernames and passwords. To identify file transfers, search for the "STOR" and "RETR" commands, which indicate file uploads and downloads, respectively.

Case Study 7: Detecting Network Scan Activity

In this challenge, you are given a PCAP file and the task is to identify any network scanning activities, such as port scanning or host discovery.

Wireshark Tip: Use the display filter tcp.flags.syn == 1 and tcp.flags.ack == 0 to show only TCP SYN packets. Look for a pattern of multiple SYN packets targeting different IP addresses or ports, which may indicate a network scan. Alternatively, apply the display filter icmp.type == 8 to display ICMP echo requests and identify any patterns of host discovery.

By working through these additional case studies and utilizing the provided Wireshark tips, you can further develop your packet analysis skills and become more proficient in tackling CTF and creative PCAP challenges. Remember to explore our WIRED for Packet Analysis training course and take advantage of our PacketSafari online PCAP analyzer at https://app.packetsafari.com to enhance your expertise.

By practicing these case studies and applying the Wireshark tips provided, you can improve your packet analysis skills and excel in CTF and creative PCAP challenges. To further enhance your expertise, consider enrolling in our WIRED for Packet Analysis training course and trying our PacketSafari online PCAP analyzer.