Traffic CTF arena
In intermediate PCAP and Zeek puzzles you extract flags from encrypted traffic, custom protocols and fragmented files.
Level 301 · 15 lessons · 12 practice labs
Lessons
Protocol puzzles
- Decoding an undocumented protocol
- Recovering typed text from a USB keyboard capture
- A file hidden in an SMB transfer
- Completing an FTP transfer split across missing packets
- Short task: solve two protocol puzzles against the clock
Encryption and encoding
- A flag revealed with a key log
- Decoding an XORed payload by finding its key
- A hidden message in an image pulled from traffic
- Joining an archive split across DNS TXT answers
- Short task: unwrap a multi-layer encoded flag step by step
Large captures
- Finding one conversation in a million-packet capture
- A puzzle solved with Zeek logs alone
- Building a message from out-of-order fragments
- A team write-up and sharing the method
- Capstone: a timed arena round with six flags
Practice labs
- Recover typed text from a USB keyboard capture: Convert the key codes in a USB keyboard capture to letters and find the typed flag.
- Complete an FTP transfer with missing packets: Put the pieces of a split FTP data stream in the right order and read the flag from the file.
- Decode an undocumented protocol: Derive the length, type and payload fields of a custom binary protocol from samples and decode the message carrying the flag.
- A flag unlocked with a key log: Decrypt the TLS session with the supplied key log and read the flag in the response.
- Find the key of an XORed payload: Find the repeating single-byte XOR key from known plaintext and decode the flag.
- A flag encoded in several layers: Reach the flag by unwrapping Base64, hex and gzip layers in the right order and note the steps.
- Export the file from an SMB transfer: Export the SMB objects and find the document carrying the flag.
- Join an archive from DNS TXT answers: Join the archive pieces split across TXT answers in order and extract the flag inside.
- The hidden message in an image from traffic: Carve the data appended to an image you exported from HTTP and read the hidden message.
- Solve it with Zeek logs only: Without the PCAP, find the request carrying the flag from the conn and http logs alone.
- One conversation in a million packets: Find the single conversation carrying the flag in a large capture in five steps with statistics and filters.
- Build a message from shuffled pieces: Arrange segments with scrambled time order by sequence number and rebuild the message.
About this course
In intermediate PCAP and Zeek puzzles you extract flags from encrypted traffic, custom protocols and fragmented files.
What you will learn
- Protocol puzzles
- Encryption and encoding
- Large captures
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.