Capture The Flag Bootcamp 1

In a CTF context, "Forensics" challenges can include file format analysis, steganography, memory dump analysis, or network packet capture analysis. Any challenge to examine and process a hidden piece of information out of static data files (as opposed to executable programs or remote servers) could be considered a Forensics challenge (unless it involves cryptography, in which case it probably belongs in the Crypto category).&nbsp;
Forensics is a broad CTF category that does not map well to any particular job role in the security industry, although some challenges model the kinds of tasks seen in Incident Response (IR). Even in IR work, computer forensics is usually the domain of law enforcement seeking evidentiary data and attribution, rather than the commercial incident responder who may just be interested in expelling an attacker and/or restoring system integrity.
Unlike most CTF forensics challenges, a real-world computer forensics task would hardly ever involve unraveling a scheme of cleverly encoded bytes, hidden data, mastroshka-like files-within-files, or other such brain-teaser puzzles. One would typically not bust a criminal case by carefully reassembling a corrupted PNG file, revealing a photo of a QR code that decodes to a password for a zip archive containing an NES rom that when played will output the confession. Rather, real-world forensics typically requires that a practictioner find indirect evidenceof maliciousness: either the traces of an attacker on a system, or the traces of "insider threat" behavior. Real-world computer forensics is largely about knowing where to find incriminating clues in logs, in memory, in filesystems/registries, and associated file and filesystem metadata. Also, network (packet capture) forensics is more about metadata analysis than content analysis, as most network sessions are TLS-encrypted between endpoints now.
This disconnect between the somewhat artificial puzzle-game CTF "Forensics" and the way that forensics is actually done in the field might be why this category does not receive as much attention as the vulnerability-exploitation style challenges. It may also lack the "black hat attacker" appeal that draws many players to participate in CTFs. Regardless, many players enjoy the variety and novelty in CTF forensics challenges. It can also be a more beginner friendly category, in which the playing field is evened out by the fact that there are no $5,000 professional tools like IDA Pro Ultimate Edition with Hex-Rays Decompiler that would give a huge advantage to some players but not others, as is the case with executable analysis challenges.&nbsp;

twork Forensics - TRACKING HACKERS THROUGH CYBERSPACE
Case study : Ann’s&nbsp;
The mission - The case: After being released on bail, Ann Dercover disappears! Fortunately, investigators were carefully monitoring her network activity before she skipped town. “We believe Ann may have communicated with her secret lover, Mr. X, before she left,” says the police chief. “The packet capture may contain clues to her whereabouts.”
Challenge: You are the forensic investigator. Your mission is to analyze the packet capture and gather information about Ann’s activities and plans. The following questions will help guide your investigation:
<ul>
<li>Provide any online aliases or addresses and corresponding account credentials that may be used by the suspect under investigation.</li>
<li>Who did Ann communicate with? Provide a list of email addresses and any other identifying information.</li>
<li>Extract any transcripts of Ann’s conversations and present them to investigators.</li>
<li>If Ann transferred or received any files of interest, recover them.</li>
<li>Are there any indications of Ann’s physical whereabouts? If so, provide supporting evidence.</li>
</ul>

The mission continued
Network:
Internal network: 192.168.30.0/24
DMZ: 10.30.30.0/24
The “Internet”: 172.30.1.0/24 [Note that for the purposes of this case study, we are treating the 172.30.1.0/24 subnet as “the Internet.” In real life, this is a reserved nonroutable IP address space.]
Evidence: Investigators provide you with a packet capture from Ann’s home network, “evidence-packet-analysis.pcap.” They also inform you that in the course of their monitoring, they have found that Ann’s laptop has the MAC address 00:21:70:4D:4F:AE.

CTF Flags :
What is Ann's email address ?
What is Ann's email password ?
What is Ann's secret lover's email address ?
what to items did ann tell her secret lover to bring ?
What is the name of the attachment Ann sent to him?


Let's Start The CTF
download lab zip file and extract in your pc ,there you will get file evidence-packet-analysis.pcap&nbsp;
now we need a software for analysis pcap file.
go to this link and download tool wireshark -<a href="https://www.wireshark.org/download.html" target="_self"> https://www.wireshark.org/download.html</a>&nbsp;

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/Jz5zf2hV45MjBLLnixRrE.jpeg" alt="" style="height: auto;width: auto"/>
download according to your OS.
after this double click on download file then will we appear a dialog box on your screen click on yes then click on next.

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/N_286YgL83tiNkZ_jRbfh.jpeg" alt="" style="height: auto;width: auto"/>
click on next

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/TrZPsh35C6I0zA63rVP5K.jpeg" alt="" style="height: auto;width: auto"/>
click on noted

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/19ArYpIXOm1BdwFCajS0z.jpeg" alt="" style="height: auto;width: auto"/>
click on next

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/dAkg0HM7xqiVxAV3ydmtw.jpeg" alt="" style="height: auto;width: auto"/>
click on next

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/wr_tGYZhUQ1UMJJws-coz.jpeg" alt="" style="height: auto;width: auto"/>
click on next

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/rMouCzRNZmD-r3HBpa-F3.jpeg" alt="" style="height: auto;width: auto"/>
click on install

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/UN1v_Wev8vdy3L59mRQ7x.jpeg" alt="" style="height: auto;width: auto"/>
now you will again get pop up on your screen&nbsp;

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/PcO6vZbFH9g_00CB93SMA.jpeg" alt="" style="height: auto;width: auto"/>
click on i agree

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/0SbYFu9OuVH_5btok5NdQ.jpeg" alt="" style="height: auto;width: auto"/>
click on install

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/Jz9jMJB_WZqCkfY49ICvU.jpeg" alt="" style="height: auto;width: auto"/>
you will get here antivirus notification ignore this. after install click on next, click on finish.

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/WFMbEuwR54CkgM5SpMkQ8.jpeg" alt="" style="height: auto;width: auto"/>
click on next

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/FUsJ7SGFDQfMBXAYsOCx5.jpeg" alt="" style="height: auto;width: auto"/>

select option i want to manually reboot later then click on finish.
go to windows search box and type wireshark and click on open.

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/UD3U6WRwTKiObqL1pjf0p.png" alt="" style="height: auto;width: auto"/>


<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/M7m6F5WaPivfM8mw0q9NB.png" alt="" style="height: auto;width: auto"/>
click on file menu then click on open and select this file Ann Case Evidence.pcap, click on open.

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/-atw54Hur0QtkOyFQVp3Q.png" alt="" style="height: auto;width: auto"/>
after open, it will be show like that

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/WQJhXIsfU9QNg-_vdp8q9.png" alt="" style="height: auto;width: auto"/>

Analysis: protocol summary
Begin by taking a high-level look at the packet&nbsp;
Click on Statistics menu, then click on Protocol Hierarchy option

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/AnYoIwhh-Wzs7LL6tQRvI.png" alt="" style="height: auto;width: auto"/>


<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/5cnJ2S6JzZh45ws_Ymyud.jpeg" alt="" style="height: auto;width: auto"/>


Notice the presence of “Bootstrap Protocol”
Used for DHCP request and response&nbsp;
click on now close button

let's move to first flag&nbsp;
What is Ann's email address ?&nbsp;
go to filter box and type this filter command and hit enter - tcp.stream

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/TUujV3Yu08h1JiecffLZV.png" alt="" style="height: auto;width: auto"/>

after enter ouput

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/pcoxDqUNGmMO2uRJJ2_M7.jpeg" alt="" style="height: auto;width: auto"/>
here showing information about email id and password but we need find informarion about ann dercover for that scroll down and carefully check.

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/avWXy4Am3Zdl17mQXuIOp.jpeg" alt="" style="height: auto;width: auto"/>
i have got it here&nbsp;
now you right on this then click on follow &gt; TCP Stream

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/YG33Ks5OnaV9G5tk165ou.png" alt="" style="height: auto;width: auto"/>

after click here you will get this output

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/FnzRXXB3pF7T6998QiHUk.jpeg" alt="" style="height: auto;width: auto"/>
we have got it here our first flag&nbsp;
sneakyg33k@aol.com

Let's move to 2nd flag
What is Ann's email password ?&nbsp;
close follow tcp stream box and find password carefully in this records&nbsp;

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/nmyrBGiuwmc-UF8ytDY1Q.jpeg" alt="" style="height: auto;width: auto"/>
we have got it here 2nd flg
NTU4cjAwbHo=
but this is string, it's not actual password so now we need to decode this first of all go to this website and find what type of hash.<a href="https://www.tunnelsup.com/hash-analyzer/" target="_self"> https://www.tunnelsup.com/hash-analyzer/</a>&nbsp;

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/GBr5RQF6Qjd87GTLx2IsB.jpeg" alt="" style="height: auto;width: auto"/>
finally we got it out 2nd flag&nbsp;

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/Oyq7J72hf0BNIuzr13Ewc.jpeg" alt="" style="height: auto;width: auto"/>

this is base64 string now we need to decide this for that go to this website and decode this - <a href="https://www.base64decode.org/" target="_self">https://www.base64decode.org/</a>&nbsp;
558r00lz

Let's Move to 3rd CTF
What is Ann's secret lover's email address ?&nbsp;
again go to filter box and type this filter command hit enter - tcp.stream

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/cVuY0xLOjCyuNW5vddW0I.png" alt="" style="height: auto;width: auto"/>
check here next flag&nbsp;

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/frdFghs12JM1zoMY_OepC.jpeg" alt="" style="height: auto;width: auto"/>
we have got it here our 3rd flag now you right click on this and go to follow tcp stream

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/GaopR9fxG75SW-J1-hT1J.png" alt="" style="height: auto;width: auto"/>

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/Nq_N26yRfdEgiWTp9o8G5.jpeg" alt="" style="height: auto;width: auto"/>
3rd flag&nbsp;
mistersecretx@aol.com

Let's Move Flag 4th
what to items did ann tell her secret lover to bring ?&nbsp;
scroll down and read message carefully&nbsp;

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/H1yZfpA163ZKnm0kRfzWR.jpeg" alt="" style="height: auto;width: auto"/>

we have got it here our next flag&nbsp;
Bring your fake passport and a bathing suit

Let's Move To Final Flag
What is the name of the attachment Ann sent to him?&nbsp;
scrolldown and read message carefully and find your final flag.

<img src="https://cyberyami-mern-bucket.s3.ap-south-1.amazonaws.com/JfOjKG9Jyx2ImfIWTWu1V.jpeg" alt="" style="height: auto;width: auto"/>

finally we have got here our final flag
filename="secretrendezvous.docx"

CTF Dot and next line 
<h4>Statement</h4>
“Rien de trop est un point dont on parle sans cesse et qu’on n’observe point.”&nbsp;
Flag: chatelet15h&nbsp;

Note: identify hash value and decode

Find orignal file's hash value in this list
9d1401f98ab27eae6f95e89444d6d5e038e7b0fc
b8ef5a3f2fcd395440b1e62d73275d71b9e0274f
b5b9eabf91629937602a600b8abf4422e0859192

Knowing the language is good things. While developing the website some secret is left over mistakely by developer. Find it what developer left in the platform.
Challenge link : <a href="http://source.cyberyami.in" target="_blank">http://source.cyberyami.in</a>&nbsp;
Note :&nbsp;
<ol>
<li>Do not use any automation tools like dirbuster,nmap, hydra etc</li>
<li>Do not bruteforce the platform.</li>
<li>Solve this challenge using provided challenge link.</li>
</ol>

Do you know what is robots, come here and find some robot and let us know what you find.
Challenge link : <a href="http://robot.cyberyami.in" target="_blank">http://robot.cyberyami.in</a>&nbsp;
Note:
<ol>
<li>Do not use any automation tools like dirbuster,nmap, hydra etc</li>
<li>Do not bruteforce the platform.</li>
<li>Solve this challenge using provided challenge link.</li>
</ol>

Challenge Link: <a href="http://cookie.cyberyami.in" target="_blank">cookie.cyberyami.in</a> .&nbsp;

Note:
<ol>
<li>Do not use any automation tools like dirbuster,nmap, hydra etc</li>
<li>Do not bruteforce the platform.</li>
<li>Solve this challenge using provided challenge link.</li>
</ol>

What happened if someone injected malicious code in the text field or url where database is connecting from backend side. Try to inject some code and find the flag.
Challenge link : <a href="http://52.23.235.21:8888/" target="_blank">http://sqli.cyberyami.in</a>
Note:
<ol>
<li>Do not use any automation tools like dirbuster,nmap, hydra etc</li>
<li>Do not bruteforce the platform.</li>
<li>Solve this challenge using provided challenge link.</li>
</ol>

Capture The Flag Bootcamp 1

Course Overview

Skills you will learn

Course Structure

Secure your Completion Certificate

Related SkillUp Courses:

Start your 7 days free trial