{"id":1441,"date":"2026-09-06T16:50:10","date_gmt":"2026-09-06T16:50:10","guid":{"rendered":"https:\/\/www.securesteps.tn\/?p=1441"},"modified":"2026-09-06T16:50:10","modified_gmt":"2026-09-06T16:50:10","slug":"min-beste-venn-nns-ctf-walkthrough","status":"publish","type":"post","link":"https:\/\/www.securesteps.tn\/ar\/min-beste-venn-nns-ctf-walkthrough\/","title":{"rendered":"Min beste venn \u2014 PCAP Bit Encoding | NNS CTF"},"content":{"rendered":"

Min beste venn \u2014 PCAP Bit Encoding<\/h1>\n

Platform:<\/strong> NNS CTF 2026
Category:<\/strong> Forensics<\/p>\n

1. Initial inspection<\/h2>\n

The archive contains a single capture, capture.pcap<\/code>. A packet count shows 3,662 TCP packets, and filtering for HTTP requests reveals that the traffic is dominated by HEAD<\/code> requests to static.notion-static.com<\/code>. The requests do not carry an obvious flag in their bodies.<\/p>\n

The unusual feature is the requested path. Paths end in numeric CSS filenames, and the numeric values use only digits 0<\/code> through 7<\/code>. That strongly suggests octal positions or an intentionally restricted bit index rather than ordinary asset names.<\/p>\n

2. Finding the encoding rule<\/h2>\n

Each logical message is separated by a prefix such as d\/h\/0<\/code>, d\/h\/1<\/code>, d\/c\/0<\/code>, or d\/c\/1<\/code>. Within a group, a numeric suffix appears either once or twice. Treat the suffix as a position and the multiplicity as its bit:<\/p>\n

    \n
  • one request for a position means bit 0<\/code>;<\/li>\n
  • two requests for a position mean bit 1<\/code>.<\/li>\n<\/ul>\n

    Sort the numeric positions before reading them. Sorting is essential because packet order is not the encoding order; the suffix itself supplies the position.<\/p>\n

    3. Turning groups into bytes<\/h2>\n

    After mapping multiplicity to bits, concatenate the bits in sorted-position order and consume them eight at a time. Convert each eight-bit chunk to a byte. Decode all four streams instead of stopping at the first readable text. The d\/h<\/code> streams contain prompts and framing, while the d\/c\/1<\/code> stream contains the complete flag.<\/p>\n

    4. Reproduction<\/h2>\n
    import collections, re, subprocess\n\nraw = subprocess.check_output([\n    \"tshark\", \"-r\", \"forensics_min-beste-venn\/capture.pcap\",\n    \"-Y\", \"http.request\", \"-T\", \"fields\",\n    \"-E\", \"separator=|\", \"-e\", \"http.request.uri\",\n], text=True)\n\nfor prefix in (\"d\/h\/0\", \"d\/h\/1\", \"d\/c\/0\", \"d\/c\/1\"):\n    counts = collections.Counter()\n    for uri in raw.splitlines():\n        match = re.search(r\"\/\" + re.escape(prefix) + r\"\/([0-9]+)\\\\.css$\", uri)\n        if match:\n            counts[int(match.group(1))] += 1\n    positions = sorted(counts)\n    bits = \"\".join(\"1\" if counts[p] > 1 else \"0\" for p in positions)\n    decoded = bytes(int(bits[i:i+8], 2)\n                    for i in range(0, len(bits)-7, 8))\n    print(prefix, decoded)<\/code><\/pre>\n
    5. Result and validation<\/h2>\n
    The decoded streams include readable challenge dialogue. The d\/c\/1<\/code> stream yields the complete flag, including its closing brace:<\/p>\n
    NNS{1_l0v3_ch4tt1ng_w1th_m1n_b3st3_v3nn_1n_th3_cl0ud5}<\/code><\/pre>\n
    This is stronger than finding a matching string in packet metadata: the result comes from a deterministic transformation of the complete capture and the other streams provide contextual confirmation.<\/p>\n
    6. Lessons<\/h2>\n
      \n
    • Repeated requests can encode data through metadata rather than payloads.<\/li>\n
    • Packet order and logical position are different; always test the ordering rule.<\/li>\n
    • Decode every stream so framing and prompts can validate the interpretation.<\/li>\n
    • Keep the original PCAP and decoder together for future competitions.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
      Detailed NNS CTF forensics walkthrough explaining how HTTP request multiplicity encoded bytes and how to decode the PCAP reproducibly.<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[31],"tags":[],"class_list":["post-1441","post","type-post","status-publish","format-standard","hentry","category-networksecurity"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t