Need a explanation for doing each in depth and the concepts as well.

 

https://cs6035.s3.amazonaws.com/MITM/mitm_spring2024.pcap

 

Your second task will require you to recover a payload from the conversation.you will need to review the conversation between members of TNC and gather incriminating data from this conversation. It appears that one of the hackers recently accessed this server and downloaded a file from it. As a last minute request, the Attorney General is asking you to investigate what this file is, and where it is hosted.

 

It seems that the file transferred is encrypted. What encryption method or algorithm was used to encrypt the file? (Just the 3-letter name)

 

If you decrypt and run the file, you'll get a unique hash based on your UserID. What is the hash generated?

 

It appears that one of the hackers recently accessed this server and downloaded a file from it. As a last minute request, the Attorney General is asking you to investigate what this file is, and where it is hosted.

 

What is the IP address for the server in question?

 

What is the username and password used to log in the server?

 

One file is downloaded from the server, what is the file name?

 

What is the programming language used to make the file? (The hackers are using a common encoding format to hide the real contents)

 

If you run this file you'll get a Combined hash. What is the unique hash for your UserID (i.e 902042)?

 

hackers are getting smart and they have a website called didazfwbreak.com that has absolutely nothing to do with Azure Firewalls but everything to do with web application firewalls. Apparently there are some weaknesses integrated into the website which allow you to get to different parts of the website something called a path traversal attack.

 

There is a flag labeled 5.1 that outputs a hash when you input in your UserID. Try to find the page and recover the flag

 

What is the directory name that contains the hint for 5.3?

 

There is a flag labeled 5.3 that outputs a hash when you input in your UserID. Try to find the page and recover the flag