Authors: Nathan Yam, Jonathan Kartawidjaja
In this challenge, the user is given a packet capture file containing a potential secret. For those unaware, a packet capture or PCAP file, contains a list of sniffed network packets.
In this case the challenge description indicates that the file contains traffic that relates to a cleartext service that can host files.
The service in question in this case, is FTP (File Transfer Protocol), which as the name suggests, is a protocol that provides an interface to download files across a network.
FTP, also has a specific protocol/port designated for transferring that file, FTP-Data.
In order to solve this challenge, we may use the network traffic analyzer, wireshark. If you are on Windows or MAC, you may need to install this tool. To open a PCAP file with wireshark, we can simply double click on it.
Let’s now apply a display filter in the top left. To query explicitly for FTP traffic, we can simply type ftp and hit ‘Enter’.
You may now manually browse through the files, till you see anything interesting.
It appears that there is a secret_recipe.txt on the file server. Let’s try to examine that file. Recall that FTP serves data through the FTP-Data protocol. We will need to change the display filter to ftp-data, as a result.
Finally, we can click on the packet to inspect its content.