ctf.nitaimaarek.com Learn Leaderboard Log in Sign up

Grab an API key header

Practitioner 20 pts

Goal: Read the API key a service call leaks in a custom request header.

Open Wireshark on your active interface and start a capture. Display filter for this level: http.request. No GUI? sudo tcpdump -i any -w cap.pcap port 9080.
Open the plaintext lab and click Generate traffic once.
Stop the capture. The secret is in the X-API-Key header on the /api/data request. Expand the request headers and read the custom X-API-Key: value.

Genuinely unencrypted — the secret exists only on the wire, never on the page.

Open in order — they nudge, not solve.

Hint 1

Find the request to /api/data (filter http.request).

Hint 2

Expand the request headers and look for the non-standard one — X-API-Key:.

Hint 3

Its value (APIKEY-…) is the answer.