ctf.nitaimaarek.com Tracks Leaderboard Log in Sign up

Tracks / WebSocket Hijacking / Frames in Flight

Frames in Flight

Medium 30 pts

A capture of a chat client connecting over a plain ws:// socket: the HTTP upgrade, then the frames. The server pushes a config frame the UI never displays, and — being a server frame — it is unmasked and sitting in the clear. Open it in Wireshark and read what the page never showed.

Hints

Open them in order. They nudge, they do not solve.

Hint 1

Find the HTTP handshake first — the GET with Upgrade: websocket and the 101 reply.

Hint 2

After the 101, apply the display filter websocket to list the frames.

Hint 3

The client frames are masked; the server frames are not. The flag is in a server-sent 'config' frame.

The capture

Forged on this server. Open it in Wireshark, or run tshark -r ws-frames.pcap.

Download ws-frames.pcap

Submit the flag

You can solve it now, but to save the solve you need an account. Sign up or log in — it takes ten seconds.