ctf.nitaimaarek.com Tracks Leaderboard Log in Sign up

Tracks / Traffic Analysis / Hello, Stranger

Hello, Stranger

Medium 25 pts

Every byte of payload here is TLS-encrypted and you do not have the keys. You do not need them: the browser announced where it was going before encryption started. Find the one destination that does not belong.

Hints

Open them in order. They nudge, they do not solve.

Hint 1

The first packet a client sends in any TLS session is the ClientHello: tls.handshake.type == 1.

Hint 2

Expand one: Handshake → Extensions → server_name. That hostname is in the clear.

Hint 3

Right-click server_name → Apply as Column and read the whole list at once.

The capture

Forged on this server. Open it in Wireshark, or run tshark -r sni.pcap.

Download sni.pcap

Submit the flag

You can solve it now, but to save the solve you need an account. Sign up or log in — it takes ten seconds.