Read the web request
The capture at /home/student/case/capture.pcap contains some plain HTTP traffic, including a login. Read it and pull out three things: the website host, the page that was requested, and the password that leaked.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
`tcpdump -nAr
The password is in the POST body as `password=...` -- strip `\r` first to keep it clean.
Solution explanation
Because the traffic was plain HTTP, you could read all of it: the host portal.example.com, the requested page /admin, and the leaked password SpringTime2026. An attacker sniffing this network would have the login instantly. That is the whole lesson of this module — on HTTP there are no secrets, so any credential seen here must be considered compromised and changed.
Show solution
tcpdump -nAr /home/student/case/capture.pcap 'tcp port 80' 2>/dev/null | grep -E 'GET|POST|Host:'
tcpdump -nAr /home/student/case/capture.pcap 'tcp port 80' 2>/dev/null | tr -d '\r' | grep 'password='