Reading a pcap — cleartext credentialseasynot started
A packet capture (capture.pcap) contains an HTTP login over cleartext. Find the credentials/flag inside the captured traffic. Use Wireshark (Follow TCP Stream) or the in-page byte viewer.
1. Open capture.pcap in Wireshark → right-click the HTTP packet → Follow → TCP Stream (or use the in-page viewer which prints printable strings). Why: HTTP is cleartext, so the full request — including the POST body — is visible.
2. The POST body to /login contains user=admin&password=THM{...}. The flag is the password value.
Lesson: always use TLS; cleartext protocols expose credentials to anyone on path.