# Ssleepy - 70 Points

We got a pcap file that shows some data transferred through FTP protocol.
Looking at the FTP-Data packets, we can see a zip file being transferred.


Export the bytes as .zip file. The zip contains .pem file(a key).
Looking at the task name again, it is actually about ssl traffic.
So, we need to decrypt the SSL traffic using the private key obtained from the zip file.

Go to Edit --> Preferences --> Choose SSL in the protocols tab.

In here, select the private key, client IP, port in **"RSA key lists"**.


After applying the key, we can see the decrypted traffic.


We can see the GET request of Flag.jpg. Following the **SSL Stream**, gives us the JPEG file.


Editing the top few lines of the jpeg in HexEditor gives the flag.

Flag : **tjctf{WIRESHARK_OR_SHARKWIRE?}**


### Flag can be seen before extracting the .jpg file

Following the SSL Stream of the GET /index.html, shows the flag in the title of the webpage.
It is shown as Sharkwire_or_Wireshark?(the two strings are in different positons though:P)

Original writeup (https://github.com/TheRealOddCoder/tjctf2018/tree/master/Ssleepy).