SANS Holiday Hack Challenge 2022 - Tokein RIng
The Tolkein Ring As we walk into the Talkain Ring area we found our old friend Sparkle Redberry, and like always, he needs our help. We download the PCAP through the link he provides and we enter the terminal to find more instructions First question We open the PCAP with Wireshark and go to the menu File --> Export Objects and choose HTTP ... (that's the answer, HTTP) We immediately see the files downloaded, this also give us the answer to the next question HTTP Objects Downloaded Using the screenshot above we can answer question 2. and 3 Now for question 4 we have to go a bit deeper and choose one of the HTTP streams to see that the responding HTTP headers says Server: Apache And there we can see the IP address to answer the question Now for question file, we can save the app.php file to our computer from the Wireshark File menu using the same Export Object option as above. To look at the last few lines of the file we use the tail command and we can see there's a blob being...