Day 13: Wireshark – Session & File Reconstruction lab

🎯 Objective

Learn how to reconstruct sessions and extract transferred files from PCAP data using Wireshark. The goal is to identify and extract a suspicious file transferred during an HTTP session.

---

🧠 Challenge Description

In this simulation, a suspected internal user has downloaded a suspicious file from a malicious server hosted at http://malicious.talosec.lab. As a SOC analyst, your job is to:

1. Identify the HTTP session where the download occurred.

2. Reconstruct the full TCP session.

3. Extract the file.

4. Inspect it for indicators of compromise (IoCs).

5. Locate and submit the embedded flag (e.g., TSEC{} format).

---

🛠️ Tools Required

• Wireshark (latest version)

• Optional: CyberChef, Base64 decoder, or VirusTotal for analyzing decoded data

---

🧭 Steps to Solve

https://www.dropbox.com/scl/fi/xx81fgt0d3hd9stiznp1a/day-13.pcap?rlkey=65m2jx8giaoyulphwinbdmkpv&st=va395ku5&dl=0

---

🔎 Step-by-Step Guide

1. Open Wireshark & Filter HTTP Traffic

   • Launch Wireshark and load the PCAP file.

   • Use display filter:

     http

2. Locate File Transfer Request

   • Look for an HTTP GET request that points to a file.

     • Example:

       GET /evil_payload.exe HTTP/1.1
       Host: malicious.talosec.lab

   • Right-click the GET request → Follow → TCP Stream

3. Review the Stream

   • Wireshark displays the full HTTP request and the server's response.

   • Scroll down to the response — the raw binary content begins after HTTP headers.

4. Analyze the File

   • Open the file in a hex editor, strings utility, or submit to VirusTotal.

   • Search for string patterns like TSEC{...} or any suspicious behavior.

5. Submit the Flag

   • Example extracted flag:

     TSEC{....}

---