Packet Whisper

Recover credentials, lookups and a stolen file from a single packet capture using Wireshark.

Scenario

You are a junior analyst at Larkspur Logistics. A workstation on the office network was flagged after it pulled a payroll export in the middle of the morning, and the network team saved a short packet capture of its traffic.

Old services are still running on the internal network, and some of them do not encrypt anything. Your task is to open the capture, work out what the workstation did and in what order, and recover every credential and file that crossed the wire in the clear.