ctf.nitaimaarek.com Learn Leaderboard Log in Sign up

Steal a session cookie

Apprentice 10 pts

Goal: Find the session cookie the server hands out and read its value.

Open Wireshark on your active interface and start a capture. Display filter for this level: http.response. No GUI? sudo tcpdump -i any -w cap.pcap port 9080.
Open the plaintext lab and click Generate traffic once.
Stop the capture. The secret is in the Set-Cookie header on the /dashboard response. Expand the response headers and read Set-Cookie: session=….

Genuinely unencrypted — the secret exists only on the wire, never on the page.

Open in order — they nudge, not solve.

Hint 1

Cookies are set by the server. Filter http.response (or http.set_cookie).

Hint 2

Find the /dashboard response and expand its headers for Set-Cookie:.

Hint 3

It sets session=… — the SESS-COOKIE-… value is the answer (exactly what an attacker replays to hijack the session).