LetsDefend: Compromised Chat Server — ten questions, one pcap

GET counts, CSRF tokens, plaintext credentials, a malicious plugin and a path traversal CVE. The Wireshark filters that answer each question.

I recorded this one a lot of times before it worked, so it may look a bit funky. Three days of frustrating moments. We got there.

Careful

Those three plus a couple of variations answer nearly everything.

Two ways.

Wireshark shows the displayed count in the status bar at the bottom once it finishes loading.

Open it, go to the cookie/session data, and the token is there. Copy it out.

Follow the HTTP stream on that same login request. Credentials in a plaintext HTTP POST sit right at the bottom of the form body.

Which is its own lesson, really.

Tip

The clue is in the sequence: the attacker used the compromised login, created an account, then used the new account.

For the last command, same filter, scroll to the end of the sequence.

I'll be honest — I got tired at this point and paused the recording until I found it. That happens.

Tip

I solve about three of these a day, so if I sound like I'm remembering which one is which, that's why.

Let me know if you have questions, and I'll see you in the next one!

Contents

Skills covered