ctf.nitaimaarek.com Learn Leaderboard Log in Sign up

Decode a binary frame

Expert 30 pts

Goal: Read the ASCII secret out of a raw binary WebSocket frame.

Open Wireshark on your active interface and start a capture. Display filter for this level: websocket. No GUI? sudo tcpdump -i any -w cap.pcap port 9080.
Open the plaintext lab and click Generate traffic once.
Stop the capture. The secret is in a binary (opcode 2) WebSocket frame on /ws. Wireshark shows this frame as hex, not text. Decode the hex bytes to ASCII (bytes pane, or CyberChef → From Hex) to read the token.

Genuinely unencrypted — the secret exists only on the wire, never on the page.

Open in order — they nudge, not solve.

Hint 1

Still websocket. One frame is a binary frame (opcode 2) — Wireshark shows hex bytes, not text.

Hint 2

Those bytes are ASCII. Decode the hex: Wireshark's bytes pane, or paste the hex into CyberChef → From Hex.

Hint 3

It decodes to the BINARY-WS-… token — that's the answer.