ctf.nitaimaarek.com Learn Leaderboard Log in Sign up

Decode HTTP Basic auth

Practitioner 20 pts

Goal: Recover the password from an Authorization: Basic header on the wire.

Open Wireshark on your active interface and start a capture. Display filter for this level: http.authorization. No GUI? sudo tcpdump -i any -w cap.pcap port 9080.
Open the plaintext lab and click Generate traffic once.
Stop the capture. The secret is in the Authorization: Basic header on /api/basic. The value is Base64 of user:pass — decode it (base64 -d, or Wireshark's decoded Authorization field). The password half is the answer.

Genuinely unencrypted — the secret exists only on the wire, never on the page.

Open in order — they nudge, not solve.

Hint 1

Find the authenticated call to /api/basic; filter http.authorization.

Hint 2

Authorization: Basic <blob> is Base64 of user:pass. Decode it (base64 -d, or Wireshark's decoded field).

Hint 3

It decodes to admin:<password>. The password half is the answer.