Network Traffic Analysis Challenge 2 - Compressed Analysis

Prompt

We recently discovered that one of our servers was hacked. Discover what information was stolen, what attacks were launched, and suggest recommendations for preventing future attacks.

Answers

Q1 (5 pts) - What is the IP address of the host receiving POST messages from the attackers?
172.26.0.5

Q2 (5 pts) - What layer 2 protocol was abused allowing the hackers to intercept traffic?
ARP

Q3 (5 pts) - What is the IP address of the compromised host?
172.26.0.3

Q4 (5 pts) - What IP address did the compromised host impersonate? Enter as comma seperated IP addresses, etc: 192.168.0.1,192.168.0.2
172.26.0.4,172.26.0.5

Q5 (10 pts) - What version of NGINX is used as noted in the response headers?
1.29.4

Q6 (10 pts) - What is the value of the flag extracted by the attackers?
SKY-IDVS-8461

Q7 (20 pts) - By how many bits does the length of a packet differ from a successful guess vs an unsuccessful guess?
8

Q8 (10 pts) - What data compression algorithm is used by NGINX to compress HTTP response content?
gzip

Q9 (30 pts) - What is the name of the attack carried out to extract the flag in this packet capture. Answer with the acronym, not the full name.
BREACH

Steps I Took

Q1 — Opened pcap in Wireshark. Found the first post request and the answer was the destination field

Q2 — I saw ?errors? in the arp packets so I inspected them. I clicked on several of them and went to the arp section. noticed that two different IP addresses are sending arp replies with the same MAC

Q3 — I clicked through the packets to find which IP matched the spoofed MAC address. That led me to 172.26.0.3.

Q4 — The earlier packet analysis gave me this answer directly: 172.26.0.4,172.26.0.5.

Q5 — I filtered by HTTP and checked the response headers on one of the packets.

Q6 — While checking the response details for Q5, I found the flag for this question.

Q7 — I found one successful submission and one unsuccessful submission, then subtracted the values.

Q8 — I looked this one up directly because it was a straightforward compression question.

Q9 — I searched for attack types related to ARP spoofing, HTTP compression, and NGINX until I found the correct acronym.