Course

This challenge involves analyzing a PCAP file containing a single HTTP request. The key is embedded in the body of the HTTP response, which is compressed using deflate. You'll start by downloading the PCAP file and opening it in Wireshark. Using Wireshark, you will follow the TCP stream to reconstruct the entire connection and extract the raw data from the HTTP response.

Once you've obtained the raw data, you will need to edit out the headers and save the body of the response. To decompress the deflated content, you'll add the necessary magic bytes to the file and use the gunzip command. Alternatively, Wireshark's "Follow HTTP Stream" feature can handle the decompression for you, making it easier to retrieve the key.