Tags: http-header forensics wireshark 

Rating:

# Writeup: Lost Head:triangular_flag_on_post:

***Category : Forensic***:minidisc:\
***Points : 50***\
***Author : krn bhargav (Ryn0)*** \
***Team : Red-Knights***:warning:
## Description
>We lost some data when the connection closed, can you recover something?

[file](lostHead.pcapng)

![description](description.png)

## solution
>we have a pcap file ,open it in wireshark,filter the http protocol and check the response from 'GET challenge.php' request

>you got flag in X-Affinity header.

![wiresharkscreenshot](wiresharkscreenshot.png)

```
Flag : AFFCTF{DonT_TRust_h34d3r2}
```

Original writeup (https://github.com/Red-Knights-CTF/writeups/tree/master/2020/affinity_ctf_lite/Lost_Head).