Tags: scapy pcap scripting 

Rating:

This challenge involved a pcap file that contained ICMP 26,682 packets, all with src/dst IPs of 127.0.0.1

-----

[![](https://i.imgur.com/6c8HbWN.png)]

-----

Scrolling through the packets, some of the packets had a lot of trailing trailing characters that were the same. I created a script to see if there was any pattern that emerged.

-----

```
#!/usr/bin/env python3

from scapy.all import *

packets = rdpcap('loopback.pcap')

rawlist = []

for i in packets:
x = str(i[Raw].load)
for k in range(5,8):
if x[-k] == x[-8]:
rawlist.append(x[-8])

flag = ""
new_rawlist = rawlist[::6]
for letter in new_rawlist:
flag += str(letter)

print("The flag is: " + flag)
```

-----

This output the following:

-----

```
The TestFlag is: PPPPPPNNNNNNGGGGGGrrnnnnrrIIIIIIHHHHHHDDDDDDRRRRRRrrrrrrqqqqqq888888ggggggAAAAAAMMMMMMAAAAAAaaaaaa ccccccHHHHHHRRRRRRMMMMMMzzzzzz&&&&&&uuuuuu000000``````::::::ppppppQQQQQQ<<<<<