Loading
The security team at Sahyog Bank noticed strange DNS traffic late at night: many lookups for names under exfil.example.invalid, a domain that should not exist. Someone may be smuggling data out through DNS queries.
You are given dns.pcap. Your job: pull out every query for exfil.example.invalid, in the order they were sent. Each query's first label is a chunk of hex text. Join the chunks, decode the hex, and the result is the flag body. Wrap it in the flag format.
Use Wireshark with a display filter like dns.qry.name contains exfil, or a short script with Scapy or tshark. This pattern is real: attackers encode stolen data in DNS names because DNS traffic is rarely blocked. Spotting it is a core incident-response skill.
This challenge only. All names, addresses and data are fictional. Do not test any real system.
Stuck? Open hints in order: a nudge, then the next step, then an explicit pointer. Costs are taken from this solve's points.
Sign in to open hints.
Sign in to submit a flag.
Sign in, then solve this challenge or give up on it to read write-ups.
Files are safe practice artefacts made for this challenge. Open them on your own computer.