Read a hidden form field
Practitioner 20 ptsGoal: Recover the value of a hidden input the form submitted in its POST body.
Capture it yourself — real traffic
- Open Wireshark on your active interface and start a capture. Display filter for this level:
http.request.method == "POST". No GUI?sudo tcpdump -i any -w cap.pcap port 9080. - Open the plaintext lab and click Generate traffic once.
- Stop the capture. The secret is in the POST body sent to
/submit. Read the whole form body — past the visible fields there's an extratoken=…the page never showed. That's the answer.
Open the plaintext lab (:9080) →
Genuinely unencrypted — the secret exists only on the wire, never on the page.
Hints
Open in order — they nudge, not solve.
Hint 1
Hidden from the page, not the wire. Find the POST to /submit (http.request.method == "POST").
Hint 2
Read the full form body — alongside the visible fields there's an extra token=… the page never showed you.
Hint 3
That hidden CSRF-HIDDEN-… value is the answer.