Objective
Extract indicators and recover the flag from a pcap.
Steps
- Identify protocols with conversation statistics.
- Carve files and inspect payloads.
- Extract the flag and verify.
Notes
Include command lines and filters you used so you can reproduce quickly.