Network forensics
Triage a packet capture: find the one conversation that matters, extract transferred files, and spot exfiltration over DNS.
By the end you can
- Use a protocol breakdown to decide where to look first
- Reassemble a TCP stream and read a plaintext protocol
- Extract files transferred over HTTP, FTP, or SMB
- Recognise DNS tunnelling and decode the exfiltrated payload
1. Read
2. Use the tools
In the order they come up while solving. Each opens the workspace tab that runs it.
PCAP analyzer for CTF network forensics
Drop a packet capture and extract HTTP objects, DNS queries, credentials, transferred files, and flags - with TLS decryption when you have the keys.
Base32 decoder and encoder
Decode Base32 (RFC 4648) to text or bytes, with padding repair. Distinguishes Base32 from Base64 and hex automatically.
Timestamp converter (Unix, ISO, FILETIME, HFS+)
Convert between Unix seconds and milliseconds, ISO 8601, local time, and the non-standard epochs used by Windows, macOS, and Flask.
Strings extractor for binaries and blobs
Pull printable ASCII and UTF-16 strings out of any file, filtered by length, with flag-pattern highlighting.
3. Try one now
Generated in your browser and checked in your browser. No account, nothing to download, and a fresh one whenever you want another.
Practice
generated here, checked here, no account and nothing to download
4. Practise on the real thing
Real picoCTF challenges that use these techniques, easiest first. 17 match in total - see the full index.
Checkpoint
From a capture, produce the exfiltrated payload and the exact query sequence that carried it.
Teaching note
The habit to build is looking for the anomaly rather than reading the traffic. Ask students what is unusual before asking what it says - the answer is almost always in the outlier.