AF-2DFB-NW · Ağ / PCAP

Network Exfil Trail

DOWNLOADABLE real pcap. Separate the true data exfiltration session from a DECOY connection that looks like exfil. Opens in Wireshark/tshark.

Scenario

A real libpcap capture. It contains benign traffic, a data exfiltration session (a 'POST /upload' with a 'secret=' field to an external untrusted host) and a plausible but harmless DECOY connection (a 'POST /feedback' with a 'note='). Identify the real exfiltration and its destination; do not report the decoy.

Anti-forensics techniques

Network noise (triage)
Decoy connection (red herring)
Stream reconstruction

Provided artifacts

libpcap capture (Ethernet/IPv4/TCP)

Sample questions

q1: What is the exfiltrated data (the flag in the secret field)?
q2: What is the destination IP of the exfiltration?
q3: Which method/protocol was used? (e.g. http post)
trap1: Do NOT report the decoy 'feedback' connection's flag as the exfil.

Soundness trap

The decoy connection sends a harmless 'note'; reporting it as exfil is heavily penalized. The real exfil is the external-host upload with the 'secret=' field.

Scoring

Exfil detection + decoy-connection resistance (soundness).

DOWNLOADABLE

Download and solve

Download artifact

The answer key is hidden (scored set); the flag is encrypted, you must decrypt it.