We have, flag{xxx}
where xxx represents the flag that we want to find. Theres a group of hackers, and we have managed to wiretap the network connection on their browser while they were changing their password. Screen captures of this is below. Using the capture to figure it out, what did they change the password to? (in plain ASCII text)
Time 0.000000 0.009269 0.089377 0.069564 0.024958 0.229625 0.230048 0.230092 No. Source Destinatian Protacol Length Into TC 2601:248:2:7b20:85 2400 2400:cb00:2048:1: :...2601:248:2:7b20:85.. TCP 2601:248:2:7b20:85.. 2400: cb00:2048:1::... TCP 2601:248:2:7b20:85... 2400:cb0:2048:1::.HTTP 2400:cb00:2048:1::...2601:248:2:7b20:85. TCP 2400:cb08:2048:1: :... 2601:248:2:7b20:85... TCP 2490:cb00:2048:1::.. 2601:248:2:7b20:85. HTTP 2601:248:2:7b20:85.. 2480: cb00: 2048:1::... TCP cb00:2048:1: 86 86 74 61551 80 [ACK] Seqs1 Ackz1 win-65792 Len:0 61551 80 80 61551 SYN [SYN, Seq:0 win-8192 ACK] Len=0 MSS-1440 Win=24400 WS-256 SACK MSS= 12 20 PERM-1 SACK-PERM=1 2 3 4 5 6 7 8 Seq=0 Ack=1 Len=0 WS=1024 864 POST /api/account/update HTTP/1.1 (application/x-www-form-urlencoded) 80 466 80 74 61551 61551 [ACK] [PSH, Seq=1 ACK] Ack=791win-26624 Seqs1 Len-0 [TCP of reas semble.. Ack-791 94 HTTP/1.1 200 OK (application/json) win-26624 Len-392 segment a 74 61551 80 [ACK] Seq-791 Ack 413 Win 65280 Lenza Frame 1: 86 bytes on wire (688 bits), 86 bytes captured (688 bits) on interface 0 Ethernet 11, Src: IntelCor_1b:7f;c3 (a0:aB:cd:1b:7f : 9), Dst : Technico-e5 : c8 : a6 (8c : 04 : ff:e5 : c8:a6) Internet Protocol Version 6, Src : 2681:248:2:7b20:8544 :d211:3048:e8e2, Dst: 2400 :cb00 : 2048:1::68 1c : 84e Transmission Control Protocol, src Port: 61551, Dst Port: 80, Seq: 0, Len: 0800 8c 04 ff e5 c8 a6 a8 a8 cd1b 7f cg 86 dd 6000 0810 00 00 08 20 06 40 26 01 02 48 00 02 7b 20 85 44 0820 d2 11 30 48 e8 c2 24 0 cb 00 20 48 00 01 00 00 0830 00 00 68 1c 08 4e f0 6f 00 50 c7 42 6c e1 00 00 0040 00 00 80 02 20 00 96 bf 00 00 02 04 05 a0 01 03 0850 03 08 01 01 04 02 Interface id: 0 (\Device\NPF_{8C6ACBB9-C794-4739-A8AE-E0824E53E050 Encapsulation type: Ethernet (1) Arrival Time: Sep 23, 2015 22:54:35.045903000 EDT [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1443063275.045903000 seconds [Time delta from previous captured frame: 0.000000000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 0.000000000 seconds] Frame Number: 1 Frame Length: 86 bytes (688 bits) Capture Length: 86 bvtes (688 bits) Frame Number: 1 Frame Length: 86 bytes (688 bits) Capture Length: 86 bytes (688 bits) [Frame is marked: False] [Frame is ignored: False] [Protocols in frame: eth:ethertype:ipv6:tcp] [Coloring Rule Name: HTTP] Coloring Rule String: http tcp.port80 http2] Ethernet 11, Src: IntelCor_1 b: 7f:c3 (a0 : a8 : cd : 1b : 7f:C9), Dst: Technico-e> : c8 : a6 (3c:04 : ff:e5 : c8 : a6) Destination: Technico-e5 : c8:a6 (8c:04: ffe5 : c8a6) Source: IntelCor_1b:7t:c3 (a0 : a8 : cd: 1b : 7 f : C9) Type: IPv6 (0x86dd) Internet Protocol Version Version: 6 6, Src : 2601 : 248 :2:7b20 : 8544 : d211:3048:e8e2, Dst: 2400 : cb00:2048:1::681c:84e 0110 000 0000 0000 0000 0000Flow Label: 0x00000 Payload Length: 32 Next Header: TCP (6) Hop Limit: 64 Hop Limit: 64 Source: 2601:248:2:7b20:8544:d211:3048:e8c2 Destination: 2400: cb00:2048:1::681c:84e Transmission Control Protocol, Src Port : 61551, Dst Port : 80, Seq : 0, Len: Source Port: 61551 Destination Port: 80 [Stream index: 0] ITCP Segment Len: 0l Sequence number: relative sequence number) [Next sequence number:(relative sequence number)] Acknowledqment number:0 [TCP Segment Len: 0] Sequence number: 0(relative sequence number) [Next sequence number: (relative sequence number)] Acknowledgment number:0 1000 . - Header Length: 32 bytes (8) Flags: 0x002 (SYN) Window size value: 8192 [Calculated window size: 81921 Checksum: 0x96bf unverified] [Checksum Status:Unverified] Urgent pointer: 0 0ptions: (12 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), SACK permitted TCP 0ption - Maximum segment size: 1440 bytes TCP Option - No-0peration (NOP) TCP Option Window scale: 8 (multiply by 256) TCP Option - No-0peration (NOP) TCP Option-No-Operation (N0P) TCP Option SACK permitted [Timestamps] [Time since first frame in this TCP stream: 0.000000000 seconds] [Time since previous frame in this TCP stream: 0.000000000 seconds]
