### Misc 70 - Rock with the wired shark`Sniffing traffic is fun. I saw a wired shark. Isn't that strange?`
#ENIn this task we got dump.pcapng file to work on. We opened it in Wireshark and saw some tcp and http packets.Also HTTP GET /flag.zip request. If you follow tcp stream,
```GET /flag.zip HTTP/1.1Host: 192.168.1.41:8080Connection: keep-aliveAuthorization: Basic ZmxhZzphenVsY3JlbWE=Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36DNT: 1Referer: http://192.168.1.41:8080/Accept-Encoding: gzip, deflate, sdchAccept-Language: en-US,en;q=0.8,ht;q=0.6
HTTP/1.0 200 OKServer: servefile/0.4.4 Python/2.7.10Date: Fri, 13 Nov 2015 18:41:09 GMTContent-Length: 222Connection: closeLast-Modified: Fri, 13 Nov 2015 18:41:09 GMTContent-Type: application/octet-streamContent-Disposition: attachment; filename="flag.zip"Content-Transfer-Encoding: binary
PK.......x.mG....(...........flag.txtUT	...-FV.-FVux..............;......q.........9.....H.!...	>B.....+:PK......(.......PK.........x.mG....(.........................flag.txtUT....-FVux.............PK..........N...z.....```
It's probably a zip file. So we need to get that. `File->Export->Http`. Yet it's password protected. After few seconds looking for password, basic authentication header is present in the request. It's base64. So `base64 -D <<< "ZmxhZzphenVsY3JlbWE="` to get password, unzip an archive containing flag.txt to get flag.```IW{HTTP_BASIC_AUTH_IS_EASY}```
#MNЭнэ даалгаварт flag нууцсан dump.pcapng файл өгөгдсөн ба үүнийг Wireshark -аар нээж үзвэл tcp болон http пакетууд мөн HTTP GET /flag.zipхүсэлт байв. Tcp follow stream гэж харваас 
```GET /flag.zip HTTP/1.1Host: 192.168.1.41:8080Connection: keep-aliveAuthorization: Basic ZmxhZzphenVsY3JlbWE=Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36DNT: 1Referer: http://192.168.1.41:8080/Accept-Encoding: gzip, deflate, sdchAccept-Language: en-US,en;q=0.8,ht;q=0.6
HTTP/1.0 200 OKServer: servefile/0.4.4 Python/2.7.10Date: Fri, 13 Nov 2015 18:41:09 GMTContent-Length: 222Connection: closeLast-Modified: Fri, 13 Nov 2015 18:41:09 GMTContent-Type: application/octet-streamContent-Disposition: attachment; filename="flag.zip"Content-Transfer-Encoding: binary
PK.......x.mG....(...........flag.txtUT	...-FV.-FVux..............;......q.........9.....H.!...	>B.....+:PK......(.......PK.........x.mG....(.........................flag.txtUT....-FVux.............PK..........N...z.....```
`File->Export->Http` гээд zip файлтай болтол задлахад нууц үг асууж байв. Хэдэн секунд нууц үг хайж байталHTTP хүсэлтийн толгойд Basic Authentication header байгаа нэр нууц үгийн хоршил магадгүй нууц үг байх.Base64 decode хийгээд `base64 -D <<< "ZmxhZzphenVsY3JlbWE="`, flag.txt байгаа архивийг задлаад флаг авав.```IW{HTTP_BASIC_AUTH_IS_EASY}```