First steps in traffic CTFs
You reinforce filtering, stream following and exporting habits while finding flags hidden in small PCAP puzzles.
Level 101 · 14 lessons · 15 practice labs
Lessons
Warm-up
- How to solve a PCAP puzzle: hint, filter, evidence
- A flag hidden in a cleartext request
- A flag split across DNS queries
- A flag hidden in HTTP headers
- Short task: three flags in three short captures
Files and streams
- A flag inside a file carved from traffic
- Following a long TCP stream to find the flag
- Decoding a Base64 and hex encoded flag
- A flag hidden in a cleartext login
- Short task: export two files and prove which one holds the flag
Mixed puzzles
- A flag hidden in ICMP echo payloads
- A message read from packet timing
- Writing a solution note others can repeat
- Capstone: a mixed PCAP with five flags
Practice labs
- The flag in a cleartext request: Find the flag carried in a parameter of a cleartext web request with a filter.
- A flag split across DNS queries: Join the flag in order from the subdomains of successive DNS queries.
- A flag hidden in a cleartext login: Decode the password in a cleartext login conversation and submit it as the flag.
- Follow the long stream and find the flag: Follow a long TCP stream to find the flag hidden in the middle of the text.
- A flag in an image pulled from traffic: Export the HTTP objects in the capture and find the image that carries the flag.
- Hex and Base64 nested: Decode a flag encoded first in hex then in Base64 step by step and write the steps.
- The flag in an ICMP echo payload: Extract the flag written into ping payloads by reading the packets in order.
- A message from packet timing: Read the hidden message by turning short and long gaps between packets into symbols.
- A mixed capture with three flags: Find three flags hidden in different protocols in a single capture.
- A Base64-encoded flag: Decode the flag encoded in Base64 inside a request body.
- Which of two files carries the flag: Export two transferred files, hash them and prove which one carries the flag.
- A write-up someone else can repeat: Write a short write-up for a puzzle you solved with the filters you used and the evidence packets.
- A flag hidden in an HTTP header: Find the flag written into an unusual response header and note which packet holds it.
- A flag encoded in a cookie value: Decode the Base64 value in a request cookie header and read the flag inside.
- A header flag spread across requests: Join the flag carried one character at a time in a custom header of ten requests by ordering the requests in time.
About this course
You reinforce filtering, stream following and exporting habits while finding flags hidden in small PCAP puzzles.
What you will learn
- Warm-up
- Files and streams
- Mixed puzzles
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.