DEV Community

CTFDojo
CTFDojo

Posted on Originally published at ctfdojo.com

PicoCTF Wireshark Doo Dooo Writeup — Extract a Flag from an HTTP Capture

#ctf #security #forensics

A .pcap file is provided. Filtering on the HTTP protocol and following the TCP stream (Follow → TCP Stream) of the relevant request, the flag appears in plaintext in the response body.

  • Platform: picoGym
  • Category: Forensics
  • Points: 100 pts
  • Difficulty: Beginner
  • Tools: Wiresharktshark

Challenge description

The challenge provides a single capture.pcap file, with no hint besides the somewhat absurd challenge title. It's a classic network analysis intro: we're given a raw capture and have to find the flag hidden somewhere in the traffic exchanged.

A .pcap capture (Packet CAPture) contains every network frame observed during a session — Ethernet, IP, TCP/UDP headers, and the application data traveling on top. Without encryption, everything that transits is readable by anyone holding the capture.

Step 1 — Open the capture

We launch Wireshark and load the provided file:

$ wireshark capture.pcap
Enter fullscreen mode Exit fullscreen mode

The packet list that appears is dense: dozens, even hundreds of frames — ARP, DNS, TCP, HTTP, plus local-network background noise. Impossible to spot the flag by eye in this flood without filtering.

Step 2 — Filter on HTTP

In the display filter bar at the top of the window, we simply type:

http
Enter fullscreen mode Exit fullscreen mode

This filter only keeps packets containing an HTTP request or response (the underlying TCP transport protocol stays invisible, but Wireshark isolates the application layer we care about). The list immediately shrinks to a handful of lines: a few GETs, and their associated 200 OK responses.

No.   Time      Source          Destination     Protocol  Info
142   1.203411  10.0.2.15       104.20.3.44     HTTP      GET /page.php?flag=1 HTTP/1.1
158   1.401022  104.20.3.44     10.0.2.15       HTTP      HTTP/1.1 200 OK  (text/html)
Enter fullscreen mode Exit fullscreen mode

Step 3 — Follow the TCP stream

We spot the most promising 200 OK response (the one that actually contains text content, not just an image or a favicon). Right-click on it, then:

Follow → TCP Stream
Enter fullscreen mode Exit fullscreen mode

Wireshark then opens a new window that reconstructs the entire TCP conversation between the client and server — the full request sent by the client (GET, Host, User-Agent... headers) and the full response returned by the server (response headers, then the HTML body).

Tip: if the stream contains several HTTP objects mixed together, the Follow → HTTP Stream option is even more targeted — it isolates the HTTP exchanges directly, without the noise of TCP acknowledgments.

Step 4 — Spot the flag

In the reconstructed stream window, we use search (Ctrl+F) to look directly for the string picoCTF{:

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 46

picoCTF{***}
Enter fullscreen mode Exit fullscreen mode

The flag is returned as-is in the response body — no encryption, no encoding, nothing to decode. It was just a matter of knowing where to look.

A command-line alternative, without the GUI, using tshark (Wireshark's CLI sibling):

$ tshark -r capture.pcap -Y http -T fields -e http.file_data
Enter fullscreen mode Exit fullscreen mode

This command filters HTTP packets (-Y http) and extracts only the http.file_data field (the response bodies), which surfaces the flag directly in the terminal without having to open the GUI.

🚩 picoCTF{ flag intentionally hidden }

The flag is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

  • Unencrypted HTTP traffic (no TLS) exposes its entire content to anyone intercepting the capture — this is exactly why HTTPS is now the standard everywhere, even for "unimportant" content
  • The http display filter combined with Follow → TCP/HTTP Stream is the go-to move for any network forensics challenge
  • tshark lets you automate the same analysis from the command line, useful for scripting or handling very large captures

Originally published on CTFdojo — join the CTFdojo Discord to discuss writeups and get notified about new ones.

Top comments (0)