Rating: 4.0

## Networks/Where's skat? (134 solves)
Created by: `skat`

> While traveling over the holidays, I was doing some casual wardriving (as I often do). Can you use my capture to find where I went? Note: the flag is irisctf{the_location}, where the_location is the full name of my destination location, not the street address. For example, irisctf{Washington_Monument}. Note that the flag is not case sensitive.

We are given a PCAP file, and since we are asked where they went, (as in the destination) we can go to the end of the PCAP and look around. As they are wardriving they will be communicating with nearby routers.

We can see they are communicating with a CISCO router at the end, we can get the BSSID of this router and look it up on [Wigle](https://www.wigle.net/) for a location. [Wigle](https://www.wigle.net/) is an online index of scanned WiFi routers with GPS data attached, so if our BSSID is there we should get a rough location.

![Communication](https://seall.dev/images/ctfs/irisctf2024/ws_1.png)

BSSID: `10:05:ca:bb:40:11`

![Wigle Lookup](https://seall.dev/images/ctfs/irisctf2024/ws_2.png)

We get a hit, now where is it?

![Wigle Map](https://seall.dev/images/ctfs/irisctf2024/ws_3.png)

Looking at the structure marker nearby we seem to be at `Los Angeles Union Station`.

Which gives us the flag: `irisctf{los_angeles_union_station}`

**Files:** [wheres-skat.tar.gz](https://web.archive.org/web/20240107222928/https://cdn.2024.irisc.tf/wheres-skat.tar.gz)

Original writeup (https://seall.dev/posts/irisctf2024/#networkswheres-skat-134-solves).