ctf.nitaimaarek.com Learn Leaderboard Log in Sign up

Learn / Network / Harder frames / Reassemble a fragmented frame

Reassemble a fragmented frame

Expert 30 pts

Goal: Recover a secret the server split across several WebSocket continuation frames.

Capture it yourself — real traffic

  1. Open Wireshark on your active interface and start a capture. Display filter for this level: websocket. No GUI? sudo tcpdump -i any -w cap.pcap port 9080.
  2. Open the plaintext lab and click Generate traffic once.
  3. Stop the capture. The secret is in a WebSocket message split across continuation frames on /ws. No single frame holds it — let Wireshark reassemble the fragments (final continuation frame / Reassembled PDU) into {"type":"stream","secret":"…"}.

Open the plaintext lab (:9080) →

Genuinely unencrypted — the secret exists only on the wire, never on the page.

Hints

Open in order — they nudge, not solve.

Hint 1

Filter websocket. After the config frame the server sends one message in pieces — a text frame with FIN=0, then continuation frames (opcode 0), ending with FIN=1.

Hint 2

No single frame holds the whole secret. Let Wireshark reassemble it (the final continuation frame / Reassembled PDU), or read each fragment's payload and concatenate in order.

Hint 3

Reassembled it reads {"type":"stream","secret":"…"} — the STREAM-WS-… value is the answer.

Log in or sign up to submit your answer and save progress.

← Roadmap Skip for now →