forensicscontest测试七_黑暗切线-CSDN博客

本文链接：https://blog.csdn.net/tammyztc/article/details/144740654

原题：

Puzzle #7: Ann’s Dark Tangent (DEFCON 2010)

At long last! Here is a copy of Puzzle #7, “Ann’s Dark Tangent,” which was run at Defcon 18 (2010). This contest was unusual in that the answer was a single word. The contest was open to DEFCON 18 attendees who were at the conference. Although the contest has long since closed, you might enjoy playing around with the packet capture, which contains wireless iPad traffic.

Ann has arranged a rendezvous with Dark Tangent. You are the forensic investigator. Can you figure out their destination?

Here’s a copy of their network traffic:

evidence-defcon2010.pcap
MD5sum: 7c416421a626600f86e3702df0cac8ef

The first team to submit the correct answer wins a brand new Apple iPad.

A few notes:
1. You will not get the correct answer simply by running “strings” on the packet capture. It is more complicated than that.
2. Please do not attempt to brute-force the answer by guessing. We reserve the right to cut you off from submitting answers if you abuse the privilege.

谜题#7：安的黑暗切线（DEFCON 2010）
终于！这是谜题#7的副本，“安的黑暗切线”，在Defcon 18（2010）上运行。这场比赛的不同寻常之处在于，答案是一个单词。比赛对参加会议的DEFCON 18与会者开放。虽然比赛早已结束，但你可能会喜欢玩数据包捕获，其中包含iPad的无线流量。
安已经安排好与黑暗切线（Dark Tangent）会面。你是法医调查员。你能猜出他们的目的地吗？
以下是他们的网络流量包：https://forensicscontest.com/contest07/evidence-defcon2010.pcap

MD5：7c416421a626600f86e3702df0cac8ef

注意事项：
1.仅仅通过在数据包捕获上运行“字符串”不会得到正确答案。这比那更复杂。
2.请不要试图通过猜测来强行破解答案。如果您滥用此特权，我们保留阻止您提交答案的权利。

解题思路：

1、打开pcap文件，可以看到所有的流量都是802.11协议，无法查看到上层的更多内容信息，根据802.11协议，帧分为：管理帧、控制帧、数据帧，通过wireshark排序，可以快速找到较大的数据包，定位一个数据帧，查看其flags值：