Network Forensics

Network forensics involves analyzing network traffic captures (PCAPs) to uncover hidden data, communication patterns, or malicious activity.

In CTFs, network forensics challenges often contain:

• Flags hidden in protocols (HTTP, DNS, FTP, etc.)
• File transfers over the network
• Covert or encoded communication channels

Goal: Extract flags, reconstruct sessions, and detect anomalies.

• Inspect PCAP: tshark -r capture.pcap
• Follow HTTP streams: Wireshark -> “Follow -> TCP Stream”
• Extract DNS queries: tshark -r capture.pcap -T fields -e dns.qry.name
• Filter by protocol: tshark -r capture.pcap -Y "ftp or http"

Start by opening the PCAP in Wireshark:

• Look at protocols used
• Identify unusual ports or traffic
• Apply display filters, e.g.,

http.request
dns
tcp.port == 1337

Command-line alternative:

tshark -r capture.pcap

Reconstruct streams to extract files or messages:

HTTP files: Follow -> TCP Stream -> Save as file

FTP / SMTP transfers: follow streams to extract payloads

Flags may be embedded in:

• HTTP headers or GET/POST requests
• DNS queries (DNS tunneling)
• Base64 or hex-encoded payloads
• Unusual TCP/UDP payloads

Some CTFs hide flags in protocol misuse:

• DNS Tunneling: data encoded in subdomain labels
• ICMP / Ping: payloads hidden in ping packets
• Timing channels: flags encoded in packet timing
• Custom protocols: analyze using Scapy to parse payloads

Example: Extract DNS query names

tshark -r capture.pcap -T fields -e dns.qry.name

Network captures from corporate environments or Windows‑based systems often include NTLM, Kerberos, or HTTP authentication exchanges. These can be analyzed to recover usernames and crack captured password hashes.

NTLM (Network LAN Manager) is a challenge‑response authentication protocol. When captured in PCAPs (especially over SMB, WebDAV, or HTTP Negotiate requests), it often appears in Base64 strings within an Authorization or WWW‑Authenticate header.

PROPFIND /share HTTP/1.1
User-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045
Host: dcc01
Authorization: Negotiate TlRMTVNTUAADAAAAGAAYAHQAAAA2ATYBjAAAAA...

You’ll typically see three stages:

1. Negotiate: client requests authentication types.
2. Challenge: server issues nonce and challenge.
3. Authenticate: client responds with hashed credentials.

To recover these hash strings for offline cracking:

• Use NTLMRawUnHide to parse the capture and extract NetNTLMv1/v2 hashes:

python3 NTLMRawUnHide.py -i capture.pcap -o ntlmhashes.txt

Once collected, crack with John the Ripper or Hashcat.

# Using John the Ripper
john ntlmhashes.txt --wordlist=rockyou.txt --format=netntlmv2

# Using Hashcat
hashcat -m 5600 -a 0 ntlmhashes.txt rockyou.txt

Sample John output indicating successful cracks:

Loaded 13 password hashes ( netntlmv2 )
[RHODE_ISLAND_Z] ( CTF )
13g 0:00:00:00 DONE

Extract HTTP files using Wireshark: File -> Export Objects -> HTTP

Sometimes challenge PCAPs are intentionally truncated or corrupted. Use pcapfix to repair header and packet data:

pcapfix broken.pcap -o repaired.pcap

An online version is available: https://f00l.de/hacking/pcapfix.php

Bluetooth Low Energy (BLE) network captures may contain pairing or data exchange information.

Use Crackle to crack BLE‑encrypted connections and recover encryption keys:

crackle -i ble_capture.pcap -o decrypted.pcap

You can then load decrypted.pcap in Wireshark for further analysis.

Sometimes the challenge is to make sense of captured USB Human Interface Device (HID) data, such as USB keyboard and mouse captures.

The tool USB Capture Decoder is used to decode HID packets.

Documentation for analyzing USB HID data can be found at HID Usage Tables

• Always filter protocols to reduce noise
• Look for unusual or nonstandard port usage
• Flags may be encoded or compressed, try base64, hex, gzip
• Combine session reconstruction + payload extraction for full analysis
• If a PCAP is corrupted or truncated, repair it using pcapfix before analysis.
• Bluetooth captures sometimes require decryption, use crackle for BLE traffic.

• Password Cracking - Wordlists and hash cracking workflows.