Description

A network capture file (shark1.pcapng) is provided. The flag is hidden inside one of the captured HTTP responses, encoded with ROT13.

Overview

• The capture contains a mix of network packets.
• Filtering to the single HTTP text/html response isolates the packet containing the flag.
• The last word of the HTML content is the ROT13-encoded flag.

Background: PCAP Analysis

• A pcapng file stores captured network packets with timestamps and metadata.
• Each packet has a payload (the raw bytes of the network frame).
• HTTP response packets containing HTML content are identifiable by the Content-Type: text/html header in the payload.
• ROT13 is a Caesar cipher with a shift of 13; it is its own inverse, so applying it twice returns the original text.

Solution

Step 1: Parse the Capture File

• The Python pcapng library reads the capture and exposes each packet as a block.
• Only EnhancedPacket blocks carry actual packet data.

with open("shark1.pcapng", "rb") as f:
    scan = list(pcapng.FileScanner(f))

packets = [p.packet_data for p in scan
           if type(p) == pcapng.blocks.EnhancedPacket]

Step 2: Filter to the HTML Packet

• Most packets are TCP handshakes or binary payloads.
• Filtering for Content-Type: text/html in the raw bytes isolates the one HTTP response packet.

packet = [p for p in packets if b"Content-Type: text/html" in p][0]

Step 3: Decode and Clean the Payload

• The raw bytes are decoded with unicode-escape, then non-printable characters are stripped.
• The flag token is the last whitespace-separated word in the HTML.

packet = packet.decode("unicode-escape")
packet = "".join(c for c in packet if c.isprintable())
data = packet.split()[-1]

Step 4: Apply ROT13

• A translation table maps each letter to its ROT13 equivalent.
• Applying it to the extracted word reveals the flag.

rot13 = str.maketrans(
    "ABCDEFGHIJKLMabcdefghijklmNOPQRSTUVWXYZnopqrstuvwxyz",
    "NOPQRSTUVWXYZnopqrstuvwxyzABCDEFGHIJKLMabcdefghijklm"
)
result = str.translate(data, rot13)

Flag

picoCTF{p33kab00_1_s33_u_deadbeef}