# IWCTF 2016 - Misc - 404 Flag not found - 80 pts
> Description: I tried to download the flag, but somehow received only 404 errors :( Hint: The last step is to look for flag pattern.>> Attachment: [misc80.zip](misc80.zip)
# Write-up
The attachment contained a traffic capture with multiple DNS requests to the ctf site (with changing hexadecimal prefixes).
Obviously there's some information hidden in the dns queries. 
I used `chaosreader` to extract the requests and then wrote a script to extract the hex-strings and convert them into ascii.
```python#!/usr/bin/pythonimport osimport reimport binascii
for fn in os.listdir('read'):	with open(fn) as f:		for line in f:			if line.startswith("Host: "):				print fn				match = re.search('Host: (.*).2015.ctf.internetwache.org', line, re.S)
				s = str(match.group(1))				print s.decode('hex')```
Executing it made the requests more readable:
```session_0002.http.htmlIn the end, it's all about flasession_0004.http.htmlgs.Whether you win or lose dosession_0006.http.htmlesn't matter.{Ofc, winning issession_0008.http.html coolerDid you find other flasession_0010.http.htmlgs?Noboby finds other flags!session_0012.http.htmlSuperman is my hero._HERO!!!_session_0014.http.htmlHelp me my friend, I'm lost isession_0016.http.htmln my own mind.Always, always,session_0018.http.html for ever alone.Crying until session_0020.http.htmlI'm dying.Kings never die.Sosession_0022.http.html do I.}!
```
After stripping the filenames and formatting the text a little bit, we'll get:
```In the end, it's all about flags.Whether you win or lose doesn't matter.{Ofc, winning is coolerDid you find other flags?Noboby finds other flags!Superman is my hero._HERO!!!_Help me my friend, I'm lost in my own mind.Always, always, for ever alone.Crying until I'm dying.Kings never die. So do I.}!```
Taking only the first characters of each line reveals the flag:
`IW{DNS_HACK}`
