circusmonkey404's Security Site

PicoCTF2018 - Forensics - admin panel Objective: We captured some traffic [1] logging into the admin panel, can you find the password Solution: Downloaded the file and opened with wireshark towards the bottom of the capture I saw where the admin panel is being displayed. I found the next POST up in the log and found the password )ßò )yÜÄEö|@@ºÀ¨À¨~P0].[¾åT ð×wPOST /login HTTP/1.1 Host: 192.168.3.128 User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:59.0) Gecko/20100101 Firefox/59.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://192.168.3.128/ Content-Type: application/x-www-form-urlencoded Content-Length: 53 Connection: keep-alive Upgrade-Insecure-Requests: 1 user=admin&password=picoCTF{n0ts3cur3_9feedfbc}