# Image Upload

> HTTP is not secure. Inspect this packet dump and you will know why.
>
> Find the packet related to an image upload and extract the image. Then, find the name of the creator of this image.
>
> MD5 (dump.pcap) = 2565cf775ac71c217102ace91cc922ec
>
> **Author:** daniellimws

We were given a [pcap](https://www.comparitech.com/net-admin/pcap-guide/) file, and immediately we went to fire up our trusty ol' [Wireshark](https://www.wireshark.org/)!&#x20;

![wireshark!!](https://1326575018-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWOW1TQuFBNIp3aDtWk3v%2Fuploads%2FLbUQibGkhqcaPAhnE631%2FScreenshot%202022-06-12%20at%208.02.39%20PM.png?alt=media\&token=b149c008-e077-4ba2-8b4d-654ddaefa00a)

From here we get to see a bunch of protocols, e.g. TCP, DNS, HTTP, TLS. At first, we followed this [tutorial](https://sites.google.com/site/csatamusa/cyber-competitions/ncl/extract-images-from-pcap-file-using-wireshark) to try and extract images from a `pcap` file! Unfortunately, we didn't get to see what was expected :cry:

![no images extension? :(](https://1326575018-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWOW1TQuFBNIp3aDtWk3v%2Fuploads%2F9e2iezCsWB0lupoo5PwP%2FScreenshot%202022-06-12%20at%208.06.32%20PM.png?alt=media\&token=2a2e1300-064b-47a0-a23e-f5021db3030a)

Next, from the challenge description given, it gave us a hint that we should filter for HTTP! And so we did!

![](https://1326575018-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWOW1TQuFBNIp3aDtWk3v%2Fuploads%2F7gYm4e9jO1KGi8FbHh2B%2FScreenshot%202022-06-12%20at%208.02.55%20PM.png?alt=media\&token=05ac0377-0068-43b4-819e-4558c3441514)

We notice the `(PNG)` under the Info tab, and so we tried to extract it out by following the HTTP stream. Afterwards, renaming the file with a `.png` extension.

![Right click > Follow > HTTP Stream](https://1326575018-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWOW1TQuFBNIp3aDtWk3v%2Fuploads%2F1wQCMv5VGjdP9qumSTMb%2FScreenshot%202022-06-12%20at%2010.12.02%20PM.png?alt=media\&token=4e2f65d4-063c-4484-a1ba-a7cec291883f)

Unfortunately again, we didn't get the flag, we received an error where it says "**File** **is** **corrupted**"

So, we looked back at wireshark and took a look at the payload under "**MIME Multipart Media** **Encapsulation**" and we found the flag under "**Textual** **Data**"!

![flag!!!](https://1326575018-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWOW1TQuFBNIp3aDtWk3v%2Fuploads%2FtsrJ03W2Lf0JmZQcABqr%2FScreenshot%202022-06-12%20at%2010.17.36%20PM.png?alt=media\&token=fdd530cc-347b-45b6-9297-ef1c91ce261a)

Flag: `grey{wireshark_exiftool_are_good}`

Am I considered a hackerman now?? :point\_right::point\_left::disappointed:

![](https://1326575018-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWOW1TQuFBNIp3aDtWk3v%2Fuploads%2FxBVv8v0W09LJGRAQ9Esk%2F4895934.jpg?alt=media\&token=289f73e8-730b-433e-ad1d-584697e8cb46)
