TLS Session

Overview

A TLS 1.2 session capture along with the NSS key log file. Decrypt the traffic in Wireshark to find an HTTP file download embedded mid-stream.

Solution

Load the PCAP in Wireshark, then configure TLS decryption:

Edit > Preferences > Protocols > TLS
(Pre)-Master-Secret log filename: [browse to session_keys.log]

The traffic decrypts immediately. Filter to HTTP:

http

Three requests are visible: - GET /api/status: JSON status response - GET /api/version: JSON version response
- GET /files/personnel_roster_partial.txt: file download

Right-click the /files/... response, follow the HTTP stream. The response body is a partial personnel roster for DEADROP field assets, with most assignments redacted. The flag is at the bottom as a training exercise verification token.

To extract the file body directly:

tshark -r tls_session.pcapng \
  -o "tls.keylog_file:session_keys.log" \
  -Y 'http.response.code == 200' \
  -T fields -e http.file_data \
  | xxd -r -p

Flag: DEADROP{tls_decryption_is_cheating_and_i_love_it}

Key Takeaway

TLS protects data in transit, but only if the session keys stay secret. The NSS key log format (used by Firefox, Chrome, curl) is a standard way to capture keys for legitimate debugging and for forensic decryption when logs are available.