After opening `pcap` file in wireshark we got some HTTP trafic


But every post is differetn by last letter in url. After saving this output to a file. Last letters of every post can be extracted

```bash
grep POST exported_http | grep -v browse | awk -F_ '{print $2}'| awk '{print $1}' | sed -z 's/\n//g;s/+/ /g;s/%7B/{/g;s/%7D/}/g
```

```
Treasure PlanetDuneVoltron in SpaceTreasure PlanetDuneHighlanderHighlanderVoltron in SpaceDuneStar Trekshctf{T1m3-is-th3-ultimat3-curr3Ncy}Star Warsshctf{T1m3-is-th3-ultimat3-curr3Ncy}shctf{T1m3-is-th3-ultimat3-curr3Ncy}Star TrekDuneshctf{T1m3-is-th3-ultimat3-curr3Ncy}Battlestar GalaticaStar WarsStar TrekBattlestar Galaticashctf{T1m3-is-th3-ultimat3-curr3Ncy}Battlestar GalaticaDuneDuneVoltron in SpaceHighlanderTreasure PlanetHighlanderStar TrekStar TrekTreasure Planetshctf{T1m3-is-th3-ultimat3-curr3Ncy}Star WarsBattlestar GalaticaStar TrekBattlestar GalaticaTreasure Planetshctf{T1m3-is-th3-ultimat3-curr3Ncy}Voltron in SpaceVoltron in SpaceVoltron in Space
```

`shctf{T1m3-is-th3-ultimat3-curr3Ncy}`

Original writeup (https://github.com/SovietBeast/CTF-writeups/blob/main/Space%20Heroes%20CTF%202022/Netflix-and-ctf.md).