Pull a field from a JSON body
Practitioner 20 ptsGoal: Read a secret out of a JSON request body an API call posted.
Capture it yourself — real traffic
- Open Wireshark on your active interface and start a capture. Display filter for this level:
http.request.method == "POST". No GUI?sudo tcpdump -i any -w cap.pcap port 9080. - Open the plaintext lab and click Generate traffic once.
- Stop the capture. The secret is in the JSON POST body sent to
/api/track. Follow → TCP Stream. The body is{"event":"open","token":"…"}— take thetoken.
Open the plaintext lab (:9080) →
Genuinely unencrypted — the secret exists only on the wire, never on the page.
Hints
Open in order — they nudge, not solve.
Hint 1
Not a form this time — a JSON POST to /api/track. Find it and Follow → TCP Stream.
Hint 2
The request body is {"event":"open","token":"…"}.
Hint 3
The token field (EVENT-JSON-…) is the answer.