## Disclaimer
Please check the original writeup on https://dothidden.xyz/dantectf_2023/whocanhazflag/ if you want to see it with the pictures.
## Description of the challenge
A little spirit spied on this mortal transmission. He noticed that the human was after something, but what was it ?
## Solution
The challenge provide a Wireshark capture, let's open it first.By the name of the challenge we can guess that the flag might be related to the ARP or DNS protocol because thoseprotocolsare used to translate a domain into IP address in the case of DNS and forARP we send request in order to identify a device based on his IP address.
If we sort the capture by protocol we see the following result where we can see a lot of ARP request with the message "Who has".
What is fascinating is that if we take the last character from the hexdump of each ARP request, we find theflag of the challenge (assuming packets are also sort by id).
Continue until the end of the ARP capture and you will get `DANTE{wh0_h4s_fl4g_ju5t_45k}`.