Tags: forensics 


# Pirates
(Forensics, 150, 225 Solves)

Mr.Reed and his pirating ring has finally been caught by the police but unfortunately we dont have enough evidence to indict him.
All we could get is a network capture of his private network. Can you find any evidence to be used against him ?



### Investigation

The provided file is a packet capture file. Use Wireshark to analyse it with the command `wireshark network_listen.pcap`.

Scrolling through the different packets transmitted, you can find a few `HTTP` packets.
Find the http packet with a GET request to '/i_COULD_have_the_flag.mp4.torrent' directory. Right-click on it and select Follow > HTTP Stream.
You can find the flag in the HTTP Stream.


![HTTP Stream Screenshot](https://github.com/gddaredevil/writeups/blob/master/DeconstruCT.F_2021/pirates/HTTP_Stream.png)

Original writeup (https://github.com/gddaredevil/writeups/tree/master/DeconstruCT.F_2021/pirates).