This exercise is one of our challenges to help you learn how to analyze PCAP files

< 1 Hr.
PCAP badge


This exercise is part of the PCAP badge and involves analyzing an SMTP connection using Wireshark. You will start by downloading the provided PCAP file and inspecting it to retrieve an email that contains an attachment. The attachment is encoded in the email and needs to be decoded using the `uudecode` command.

By following the TCP Stream in Wireshark, you will identify the attachment within the email and decode it to obtain a zip file. This zip file can then be decompressed to extract the final content. The exercise not only teaches you how to use Wireshark for network forensics but also introduces you to handling encoded email attachments.

Want to learn more? Get started with PentesterLab Pro! GO PRO