ctf.nitaimaarek.com Learn Leaderboard Log in Sign up

Learn / Network / Socket frames / Unmask a client frame

Unmask a client frame

Practitioner 20 pts

Goal: Read a token the browser sent to the server in a masked WebSocket frame.

Capture it yourself — real traffic

  1. Open Wireshark on your active interface and start a capture. Display filter for this level: websocket. No GUI? sudo tcpdump -i any -w cap.pcap port 9080.
  2. Open the plaintext lab and click Generate traffic once.
  3. Stop the capture. The secret is in the masked auth frame the browser sends on /ws. Find the client→server frame (MASK: set). Wireshark unmasks it — read {"type":"auth","token":"…"}.

Open the plaintext lab (:9080) →

Genuinely unencrypted — the secret exists only on the wire, never on the page.

Hints

Open in order — they nudge, not solve.

Hint 1

This time the secret goes the other way — the client sends it. Still filter websocket.

Hint 2

Client frames are XOR-masked, but Wireshark unmasks them for you: look for the frame with MASK: set going client→server and read its decoded payload.

Hint 3

It's {"type":"auth","token":"…"} — the CLIENT-WS-… value is the answer.

Log in or sign up to submit your answer and save progress.

← Roadmap Skip for now →