Challenge description

The challenge provides a single capture.pcap file, with no hint besides the somewhat absurd challenge title. It's a classic network analysis intro: we're given a raw capture and have to find the flag hidden somewhere in the traffic exchanged.

A .pcap capture (Packet CAPture) contains every network frame observed during a session — Ethernet, IP, TCP/UDP headers, and the application data traveling on top. Without encryption, everything that transits is readable by anyone holding the capture.

Step 1 — Open the capture

We launch Wireshark and load the provided file:

$ wireshark capture.pcap

The packet list that appears is dense: dozens, even hundreds of frames — ARP, DNS, TCP, HTTP, plus local-network background noise. Impossible to spot the flag by eye in this flood without filtering.

Step 2 — Filter on HTTP

In the display filter bar at the top of the window, we simply type:

http

This filter only keeps packets containing an HTTP request or response (the underlying TCP transport protocol stays invisible, but Wireshark isolates the application layer we care about). The list immediately shrinks to a handful of lines: a few GETs, and their associated 200 OK responses.

No.   Time      Source          Destination     Protocol  Info
142   1.203411  10.0.2.15       104.20.3.44     HTTP      GET /page.php?flag=1 HTTP/1.1
158   1.401022  104.20.3.44     10.0.2.15       HTTP      HTTP/1.1 200 OK  (text/html)

Step 3 — Follow the TCP stream

We spot the most promising 200 OK response (the one that actually contains text content, not just an image or a favicon). Right-click on it, then:

Follow → TCP Stream

Wireshark then opens a new window that reconstructs the entire TCP conversation between the client and server — the full request sent by the client (GET, Host, User-Agent... headers) and the full response returned by the server (response headers, then the HTML body).

Tip: if the stream contains several HTTP objects mixed together, the Follow → HTTP Stream option is even more targeted — it isolates the HTTP exchanges directly, without the noise of TCP acknowledgments.

Step 4 — Spot the flag

In the reconstructed stream window, we use search (Ctrl+F) to look directly for the string picoCTF{:

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 46

picoCTF{***}

The flag is returned as-is in the response body — no encryption, no encoding, nothing to decode. It was just a matter of knowing where to look.

A command-line alternative, without the GUI, using tshark (Wireshark's CLI sibling):

$ tshark -r capture.pcap -Y http -T fields -e http.file_data

This command filters HTTP packets (-Y http) and extracts only the http.file_data field (the response bodies), which surfaces the flag directly in the terminal without having to open the GUI.

The flag is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

• Unencrypted HTTP traffic (no TLS) exposes its entire content to anyone intercepting the capture — this is exactly why HTTPS is now the standard everywhere, even for "unimportant" content
• The http display filter combined with Follow → TCP/HTTP Stream is the go-to move for any network forensics challenge
• tshark lets you automate the same analysis from the command line, useful for scripting or handling very large captures

Resources

• Official Wireshark documentation
• Transmission Control Protocol — Wikipedia
• tshark — official man page

Related reading

Forensics 2026-10-05 · picoGym

PicoCTF TFTP Writeup — Recover a File from a Wireshark Capture

Exporting a file transferred over TFTP from a network capture with Wireshark.