BUUCTF的wireshark流量分析题目writeup汇总

偏执的太偏执、 2024-03-26 23:22 60阅读 0赞

参加陇剑杯，发现一大堆wireshark流量分析题，但是之前甚少接触，今天在buuctf上找了一些流量分析的题进行练习。

![9cb8e1ed970c4ff7a0e6bfb770859abb.png][]

### wireshark ###

http.request.uri matches "php"

![ae893271309a4e64ae5b05a8aa8cfb8e.png][]

### 被嗅探的流量 ###

![b018970ce15642809cbd23d6fa15fcdb.png][]

### 数据包中的线索![ec9b71956d26411cb64ffad1f80ae786.png][] ###

两个需要注意的

1.Transfer-Encoding: chunked分块编码

2./9j是jpg文件头的base64编码![11ca0e9e3c6c4b1ca7060b7dd1316095.png][]![64cd396de308481aa90167191b60cb5a.png][]

![545f3fefb0b34c50af844fbd8252bf5a.png][]

flag\{209acebf6324a09671abc31c869de72c\}

### 被偷走的文件 ###

![844005b4bd7f4355ab600f676792e8a8.png][]

![c0fa850516764e5097713d450b4fa26b.png][]

rar文件

![11433cbe0c3a4391ac78391d826c4f95.png][]

要密码,爆破试一下 5790

flag\{6fe99a5d03fb01f833ec3caa80358fa3\}

### \[第九章\]\[9.4.2 键盘流量分析\]键盘流量分析 ###

![6acd050858224e5692583bfa43e06635.png][]

筛选 URB\_INTERRUPT in 的HID Data数据

网上的脚本，稍作修改:![a51af04abd51402fb7dd69a004c67722.png][]

flag\{helloworld!\}

### \[第九章\]\[9.3.1 HTTP流量分析\]http流量分析![754ff27b99074f92b02b33d48c62ceb2.png][]![23b82cff25f348f1b8f36a188255d27f.png][] ###

flag\{This\_is\_a\_f10g\}

### \[第九章\]\[9.3.2 webshell混淆流量分析\]webshell流量分析![b0122d9609c3494aaece9ac09a004d8b.png][] ###

tcp.stream eq 10 and http

再找

![c25ddbcfedf7421eba831a9c0965ed84.png][]

这中间一顿爆破爆不出来，还是得找流量![465aba07c9904ff88e71e8a1b935934b.png][]

Form item: "z1" = "RDpcd2FtcDY0XHd3d1x1cGxvYWRcNjY2Ni5qcGc="

说明下载的是6666.jpg![8f89b4acf7fc4c54b9332e732741529d.png][]![a21773be0fc8432da96945c9bafe5cbe.png][]

把z2的值全拿出来

![23f2b119d9b24177a2f17ba919bdc821.png][]

Th1s\_1s\_p4sswd\_!!!

解压之后

![660aba42f1c4464e863839c4391cbaaf.png][]

flag\{3OpWdJ-JP6FzK-koCMAK-VkfWBq-75Un2z\}

[9cb8e1ed970c4ff7a0e6bfb770859abb.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/11/a8bab21fede3447bb187106a446409c1.png
[ae893271309a4e64ae5b05a8aa8cfb8e.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/11/13d24a435b4048468e90e1c0f25f43d6.png
[b018970ce15642809cbd23d6fa15fcdb.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/11/55fef2c1181d441eab68398204a00843.png
[ec9b71956d26411cb64ffad1f80ae786.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/11/48d5e5fa8ea041fd8542976a0b113c7c.png
[11ca0e9e3c6c4b1ca7060b7dd1316095.png]: https://img-blog.csdnimg.cn/11ca0e9e3c6c4b1ca7060b7dd1316095.png
[64cd396de308481aa90167191b60cb5a.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/11/bbd0047303364ae89ba92c68b85321ca.png
[545f3fefb0b34c50af844fbd8252bf5a.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/11/7eb8167ea0ba48de86c8bd83a3eb7b07.png
[844005b4bd7f4355ab600f676792e8a8.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/11/23021d0344c44647ba3fcd6db3ae591a.png
[c0fa850516764e5097713d450b4fa26b.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/11/17832612a0f549238cd20255eb12c2c9.png
[11433cbe0c3a4391ac78391d826c4f95.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/11/e55097220a674e70b1f79d5d7503a964.png
[6acd050858224e5692583bfa43e06635.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/11/3ff28b0d0b7546e5bb22b6ce9698b860.png
[a51af04abd51402fb7dd69a004c67722.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/11/6d3f77813b7e4877bc5b6c9eeecde0d9.png
[754ff27b99074f92b02b33d48c62ceb2.png]: https://img-blog.csdnimg.cn/754ff27b99074f92b02b33d48c62ceb2.png
[23b82cff25f348f1b8f36a188255d27f.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/11/1501cdc1fbb6462bbc2e3203d0c6f4ea.png
[b0122d9609c3494aaece9ac09a004d8b.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/11/cb1e7fe8358b46e8817b2cfc57f383c8.png
[c25ddbcfedf7421eba831a9c0965ed84.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/11/e153459b93e4495ea60f850551bc4bbf.png
[465aba07c9904ff88e71e8a1b935934b.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/11/6f3d24ecc1c04e13a56a1635d53e7faa.png
[8f89b4acf7fc4c54b9332e732741529d.png]: https://img-blog.csdnimg.cn/8f89b4acf7fc4c54b9332e732741529d.png
[a21773be0fc8432da96945c9bafe5cbe.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/11/a409c913d7a64645a1ee2df370e1d234.png
[23f2b119d9b24177a2f17ba919bdc821.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/11/f750f16600904d2d8ffd31d917b42e72.png
[660aba42f1c4464e863839c4391cbaaf.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/11/ca68b52a4ae04b6dbb6873a71d76286d.png