ctf.nitaimaarek.com Learn Leaderboard Log in Sign up

Read a server frame

Practitioner 20 pts

Goal: Capture the plaintext WebSocket and read the config token the server pushes.

Open Wireshark on your active interface and start a capture. Display filter for this level: websocket. No GUI? sudo tcpdump -i any -w cap.pcap port 9080.
Open the plaintext lab and click Generate traffic once.
Stop the capture. The secret is in the server's config WebSocket frame on /ws. Find the server→client (unmasked) text frame {"type":"config","token":"…"}.

Genuinely unencrypted — the secret exists only on the wire, never on the page.

Open in order — they nudge, not solve.

Hint 1

On the :9080 lab, Generate traffic opens a cleartext ws://…/ws. Filter websocket.

Hint 2

You'll see the Upgrade handshake, then frames. This one was sent by the server (unmasked).

Hint 3

It's a {"type":"config","token":"…"} text frame — the SOCKET-WS-… token is the answer.