Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
Analyze a safe TLS-forensics fixture. traffic.pcap is a text representation of one TLS application-data capture and sslkeylog.txt is its key-log record. Do not intercept live traffic; recover the flag from the recorded decrypted payload.
Check the CLIENT_RANDOM record in evidence/sslkeylog.txt
Find the decrypted_payload_b64 line in evidence/traffic.pcap
Decode its value with base64 -d