Skip to content
ctfpal
All tools
NetworkRuns locallyNo account

PCAP analyzer for CTF network forensics

Drop a packet capture and extract HTTP objects, DNS queries, credentials, transferred files, and flags - with TLS decryption when you have the keys.

Open in ctfpal

A capture from a CTF is not a network to explore, it is a story with one relevant thread. The skill is finding that thread fast, and the shortcuts are the same every time.

The triage order

  • Protocol hierarchy. What is actually in here? A capture that is 90% one protocol tells you where to look immediately.
  • Extract objects. Any file transferred over HTTP, SMB, or FTP can be carved out whole. Frequently the flag is inside one of them.
  • Follow the stream. Reassembling a TCP conversation turns a scatter of packets into a readable transcript, which is how you read a plaintext protocol at all.
  • Credentials. FTP, HTTP Basic, Telnet, and POP3 send passwords in the clear. So does the login form of any challenge served over HTTP.
  • DNS. Long or numerous subdomain labels mean exfiltration - decode the labels, usually Base32 or hex, in query order.

Encrypted traffic

TLS is decryptable when the challenge provides key material - either the server’s private key (for older non-forward-secret suites) or, far more commonly, an SSLKEYLOGFILE containing the session secrets. If a capture is mostly TLS and no keys were provided, the intended path is metadata: SNI hostnames, certificate details, packet sizes and timing.

Common questions

Can this replace Wireshark?
For CTF triage, mostly. For deep protocol dissection across hundreds of protocols, no - Wireshark is unmatched there. ctfpal targets the specific things challenges hide in captures, without the install.

Part of a module

9. Network forensics

Triage a packet capture: find the one conversation that matters, extract transferred files, and spot exfiltration over DNS.

Practise on real challenges

Go deeper

  • PCAP triage: finding the flag in a hundred thousand packetsNetwork forensics challenges hand you a capture and no question. The triage order that finds the answer fast - protocol hierarchy, conversations, streams - plus the exfiltration channels people actually hide flags in: DNS, ICMP, USB, and TLS you can decrypt.

Related tools