# Shark of Wire

## Description

OMG! I lost all my network history data, luckily I got capture some data on a **pcap** file, maybe the flag is inside the file.

Attachment: `netword_data.pcap`

## Solution 1

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2FSQDrsUQkjTkXnaJzwoph%2Fshark-of-wire-1.png?alt=media&#x26;token=8e644a22-e318-463b-9503-ae99c791fa48" alt=""><figcaption></figcaption></figure>

Use `Protocol Hierarchy` to have an overview of the pcap file.

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2F2Tn62PVesv0MOOZdzzWm%2Fshark-of-wire-2.png?alt=media&#x26;token=d7faf19f-1fb9-4253-b230-7e77a66d578a" alt=""><figcaption></figcaption></figure>

We can see that there are several protocols. HTTP protocol is available and there are some line-based text data. Let's try to filter that out and see what's inside.

Then, you will get the flag after filtering it.

## Solution 2

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2Fasqn35we0ZcpH6Iyn5de%2Fshark-of-wire-3.png?alt=media&#x26;token=f7afacda-927d-4664-aba4-061aa7896c8d" alt=""><figcaption></figcaption></figure>

Another quicker way to solve this is to find the strings of the flag in packets.

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2FEJOgDa5i7QlaJOC3Woiu%2Fshark-of-wire-4.png?alt=media&#x26;token=f4b898ab-57f1-42a5-ae04-db23c18f87b5" alt=""><figcaption></figcaption></figure>

Choose `Packet Details` to see the details of the packet and type the flag format which is "skr" (case insensitive). The flag will be shown in the packet.
