# misc80 - '404 flag not found'

> I tried to download the flag, but somehow received only 404 errors :(

> Attachment: [misc80.zip](./misc80.zip)

Once we open up the .zip, we're greeted with yet another **.pcapng file** . Let's open that up.


All of these packets are really really odd. In two ways:

* The URLs have a subdomain of '2015' and not '2016'
* They look like blobs of hexidecimals.

So the first thing I did was see if one of the links was indeed a hexidecimal string. Easily do this by right clicking the packet's **Queries/Name** and pick **Copy>Value**


The first hexidecimal string came out to be:

In the end, it's all about fla

So each of these URLs ARE just encoded hexidecimal strings.

I took the time to lay out my notes like so:


Decoding this hex-string gives us this:

In the end, it's all about flags..Whether you win or lose doesn't matter..{Ofc, winning is cooler.Did you find other flags?.Noboby finds other flags!.Superman is my hero.._HERO!!!_.Help me my friend, I'm lost in my own mind..Always, always, for ever alone..Crying until I'm dying..Kings never die..So do I..}!.

Weird. I'd be lying if I wasn't stumped until I took a shower and got a clean mindset to realize that these groups of text held a hidden message.

Notice how there's barely any capital letters? And the first ones that are read 'IW'?

Well taking this theory, eliminating everything but the capital letters, I got this:


Weird. Whatever I'll just submit it for the lawls and ohhh..it's not right. Well it doesn't look right. So I redid the process, allowing the underscores:


Nope. Still not right.

Okay maybe there's some sort of rule that is applied on top of the actual capital letter rule.

I noticed that there is one distinctive byte (0x0A - linefeed) between each 'phrase'. So I split them up like so:

In the end, it's all about flags.
Whether you win or lose doesn't matter.
{Ofc, winning is cooler.
Did you find other flags?.
Noboby finds other flags!.
Superman is my hero.
Help me my friend, I'm lost in my own mind.
Always, always, for ever alone.
Crying until I'm dying.
Kings never die.
So do I.

Oh wow. The answer was literally right in front of me the whole time. It only takes the first capital letter or symbol before detecting another period. Reading that vertically gives the correct flag:



Original writeup (https://github.com/jmazzola/CTFs/tree/master/Internetwache%20CTF%202016/Misc/Misc80%20-%20404%20Flag%20not%20found).