Follow a TCP stream
Apprentice 10 ptsGoal: Capture your traffic and read the session token the server returns in a response body.
Capture it yourself — real traffic
- Open Wireshark on your active interface and start a capture. Display filter for this level:
tcp.port == 9080. No GUI?sudo tcpdump -i any -w cap.pcap port 9080. - Open the plaintext lab and click Generate traffic once.
- Stop the capture. The secret is in the response body of
/api/session. Right-click the exchange → Follow → TCP Stream and read thesession_tokenin the JSON response.
Open the plaintext lab (:9080) →
Genuinely unencrypted — the secret exists only on the wire, never on the page.
Hints
Open in order — they nudge, not solve.
Hint 1
Filter tcp.port == 9080, open the :9080 lab, click Generate traffic. No GUI? sudo tcpdump -i any -w cap.pcap port 9080.
Hint 2
The page fetched /api/session and threw the reply away. Right-click it → Follow → TCP Stream.
Hint 3
The JSON response has a session_token — the SESSION-TCP-… value is the answer.