# Rock With The Shark (Misc, 70pts)
---
## Problem
The shark won't bite you. Don't worry, it's wired!
## Solution
We get _pcap_ file with some HTTP transmission. Using Wireshark we can extract _flag.zip_ file, which is secured by password.
When we take a look closer at one of HTTP request and response, we find HTTP Basic Authorization header:
```GET /flag.zip HTTP/1.1Host: 192.168.1.41:8080Connection: keep-aliveAuthorization: Basic ZmxhZzphenVsY3JlbWE=Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36DNT: 1Referer: http://192.168.1.41:8080/Accept-Encoding: gzip, deflate, sdchAccept-Language: en-US,en;q=0.8,ht;q=0.6
HTTP/1.0 200 OKServer: servefile/0.4.4 Python/2.7.10Date: Fri, 13 Nov 2015 18:41:09 GMTContent-Length: 222Connection: closeLast-Modified: Fri, 13 Nov 2015 18:41:09 GMTContent-Type: application/octet-streamContent-Disposition: attachment; filename="flag.zip"Content-Transfer-Encoding: binary
PK.......x.mG....(...........flag.txtUT	...-FV.-FVux..............;......q.........9.....H.!...	>B.....+:PK......(.......PK.........x.mG....(.........................flag.txtUT....-FVux.............PK..........N...z.....
```
Base64-encoded credentials (ZmxhZzphenVsY3JlbWE=) are _flag:azulcrema_Password is valid for _flag.zip_ and we can get _flag.txt_ file with the flag:
```IW{HTTP_BASIC_AUTH_IS_EASY}