Porygon's Packet Capture

#HINTS:

1. Porygon didn't use encryption; it sent everything over raw HTTP web requests.
2. Wireshark has a built-in feature designed specifically to automatically harvest files from web traffic. Look under the "File" menu!

#METHODOLOGY:

1. Open the provided 'traffic.pcap' file inside Wireshark.

2. Look at the protocol distribution or apply a display filter for 'http' to verify that web traffic is present in the capture.

3. Instead of carving the file manually out of raw TCP streams, use Wireshark's automated object extraction feature:

   • Go to the top menu bar.
   • Select: File -> Export Objects -> HTTP...

4. A new window will pop up showing a list of all files transmitted over the unencrypted HTTP connection.

5. Look through the list for a suspicious filename (e.g., 'stolen_flag.png' or 'classified_data.txt').

6. Click on the file row, click "Save", and choose a destination on your computer.

7. Open the extracted file to read the flag: hackemon{p0ry_g0t_caught_v14_http}