The author traced a pcap file that contained TCP packets and HTTP streams. The message that caught his eye the most was one that suggested that the user had sent a POST request to the endpoint `/get/secret` endpoint content was `{"please": "false"}`.

Using the cUrl tool, the author managed to form a request to which the host responded with the flag.

```
curl -i -X POST -H "Content-Type: application/json" -d '{ "please": "true"}' http://maliciouspayload.delivery/get/secret
```