Cleartext Confession
Easy 10 ptsA capture from a small office network. Somebody signed in to the intranet over plain http://, which in 2026 is its own kind of confession. Their password is the flag, sitting in the capture exactly as typed.
Hints
Open them in order. They nudge, they do not solve.
Hint 1
Requests, not responses. Try http.request and read the Info column.
Hint 2
A password is submitted, not fetched — so it is in a POST body. Filter http.request.method == "POST".
Hint 3
Right-click that packet → Follow → TCP Stream. The form body is the last thing the client sends.
The capture
Forged on this server. Open it in Wireshark, or run
tshark -r cleartext.pcap.