Frames in Flight
Medium 30 ptsA capture of a chat client connecting over a plain ws:// socket: the
HTTP upgrade, then the frames. The server pushes a config frame the UI never displays, and — being a
server frame — it is unmasked and sitting in the clear. Open it in Wireshark and read what the page
never showed.
Hints
Open them in order. They nudge, they do not solve.
Hint 1
Find the HTTP handshake first — the GET with Upgrade: websocket and the 101 reply.
Hint 2
After the 101, apply the display filter websocket to list the frames.
Hint 3
The client frames are masked; the server frames are not. The flag is in a server-sent 'config' frame.
The capture
Forged on this server. Open it in Wireshark, or run
tshark -r ws-frames.pcap.