Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
timeline.jsonl is generated from the FLAG injected at startup. Filter exfiltration events, order by part, reverse packets, and hex-decode to recover the flag.
Inspect timeline.jsonl and identify the target record
filter exfiltration events, order by part, reverse packets, and hex-decode
Verify that the reconstructed value has FLAG{...} format