Slow Drip
Hard 45 ptsThe lab makes a long series of small requests, a few hundred milliseconds apart. Each response body carries exactly one character of the flag, and the page discards every one. No single packet has the answer; capture the whole run and put it back together in order.
Hints
Open them in order. They nudge, they do not solve.
Hint 1
Press the button once and let it finish before stopping the capture.
Hint 2
tcp.port == 9080 && http.response gives you exactly the run, in order.
Hint 3
Read one character out of each response body, top to bottom. In a saved file: tshark -r drip.pcap -Y http.response -T fields -e http.file_data.
Your live lab
Plain HTTP on port 9080 — no TLS, so your capture is readable end to end. Start capturing on your Wi-Fi interface first, then open this and use the buttons.
Display filter: tcp.port == 9080