WIRESHARK: BASICS
TOOL OVERVIEW
Use the "Exercise.pcapng" file to answer the question. Read the "capture file comments". What is the flag?
WireShark > File > Open > Exercise.pcapng
WireShark > Statistics > Capture File Properties
Capture File Comments: Flag: TryHackMe_Wireshark_DemoUse the "Exercise.pcapng" file to answer the question. What is the total number of packets?
WireShark > File > Open > Exercise.pcapng
WireShark > Status Bar
Packets: 58620
* the status bar is located on the bottom of the GUIUse the "Exercise.pcapng" file to answer the question. What is the SHA256 hash value of the capture file?
WireShark > File > Open > Exercise.pcapng
WireShark > Statistics > Capture File Properties
FILE
Hash (SHA256): f446de335565fb0b0ee5e5a3266703c778b2f3dfad7efeaeccb2da5641a6d6ebPACKET DISSECTION
Use the "Exercise.pcapng" file to answer the question. View packet number 38. Which markup language is used under the HTTP protocol?
WireShark > File > Open > Exercise.pcapng
Packet List > Packet Number 38
Packet Details > right-click eXtensible Markup Language > Copy > Description
* eXtensible Markup LanguageUse the "Exercise.pcapng" file to answer the question. What is the arrival date of the packet? (Answer format: Month/Day/Year)
PACKET NAVIGATION
Use the "Exercise.pcapng" file to answer the question. Search the "r4w" string in packet details. What is the name of artist 1?
Use the "Exercise.pcapng" file to answer the question. Go to packet 12 and read the comments. What is the answer?
Use the "Exercise.pcapng" file to answer the question. There is a ".txt" file inside the capture file. Find the file and read it; what is the alien's name?
Use the "Exercise.pcapng" file to answer the question. Look at the expert info section. What is the number of warnings?
PACKET FILTERING
Use the "Exercise.pcapng" file to answer the question. Go to packet number 4. Right-click on the "Hypertext Transfer Protocol" and apply it as a filter. Now, look at the filter pane. What is the filter query?
Use the "Exercise.pcapng" file to answer the question. Go to packet number 4. Right-click on the "Hypertext Transfer Protocol" and apply it as a filter. What is the number of displayed packets?
Last updated