# \[Forensic] WPA-ing Out (200 pts)

## Question

I thought that my password was super-secret, but it turns out that passwords passed over the AIR can be CRACKED, especially if I used the same wireless network password as one in the rockyou.txt credential dump. Use this '[pcap file](https://artifacts.picoctf.net/c/8/wpa-ing_out.pcap)' and the `rockyou` wordlist. The flag should be entered in the picoCTF{XXXXXX} format.

## Hint

Finding the IEEE 802.11 wireless protocol used in the wireless traffic packet capture is easier with wireshark, the JAWS of the network.

Aircrack-ng can make a pcap file catch big air...and crack a password.

## Solution

The challenge gave us a **pcap** file and some hints related to `rockyou` password. It seems like we must crack something to get the password.

Firstly, I imported the **pcap** file to Wireshark to analyze. I checked the protocol hierarchy to see the packet structure. As you can see in the image below, I got 2 packets from **802.1X authentication** and **Data**. I was looking around the data traffic but nothing was interesting, all the data was encrypted.

<figure><img src="https://2930324358-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MCVzu45Bb9LVrMqjdY6%2Fuploads%2F4fIQBDFuCypN5sDcuqBK%2F1.png?alt=media&#x26;token=9880a235-156b-4699-ab11-cea34276f594" alt=""><figcaption><p>pcap file</p></figcaption></figure>

<figure><img src="https://2930324358-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MCVzu45Bb9LVrMqjdY6%2Fuploads%2FpwrYiPnJTKCfvYcsTGzz%2F2.png?alt=media&#x26;token=4a58410d-cdf9-425a-87f5-fc3f7c3d8e4f" alt=""><figcaption><p>Protocol Hierarchy</p></figcaption></figure>

It’s kind of stuck, so I decided to follow the hint and tried to crack any passwords.

As a hint, I decided to use `aircrack-ng` and tried to crack the **pcap** file using `rockyou` wordlists

```bash
aircrack-ng -w /usr/share/wordlists/rockyou.txt wpa-ing_out.pcap

# /usr/share/wordlists/rockyou.txt: wordlist path
# wpa-ing_out.pcap: pcap file to crack
```

Here we go, I could get the password.

<figure><img src="https://2930324358-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MCVzu45Bb9LVrMqjdY6%2Fuploads%2FF9mRZlFM931gdfp5S2H2%2F3.png?alt=media&#x26;token=9830af67-b880-4018-97bf-ba664222328f" alt=""><figcaption><p>Crack pcap using aircrack-ng</p></figcaption></figure>

Let’s use the password and see more traffic. Open your Wireshark and go to Edit/Preferences/Protocols, choose IEEE 802.11 and edit the decryption key as in the image below. (Gone\_Surfing is the SSID of wireless)

<figure><img src="https://2930324358-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MCVzu45Bb9LVrMqjdY6%2Fuploads%2FfvKRrjgfnj7SNv3PXQuF%2F4.png?alt=media&#x26;token=994a52fb-c722-4316-b7d3-9f95b36bd8cc" alt=""><figcaption><p>Setup decryption password</p></figcaption></figure>

I checked the protocol hierarchy again, I could see more traffic was shown

<figure><img src="https://2930324358-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MCVzu45Bb9LVrMqjdY6%2Fuploads%2FKlvTHByvNWJcw4Idh8V1%2F5.png?alt=media&#x26;token=968b0c2e-16d7-46f0-ad8a-ed3b25c392a8" alt=""><figcaption><p>Protocol Hierarchy</p></figcaption></figure>

Then I could filter UDP traffic. I tried to find some information related to picoCTF but got nothing

<figure><img src="https://2930324358-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MCVzu45Bb9LVrMqjdY6%2Fuploads%2FLHcPrufq7TntPF9nJC5I%2F6.png?alt=media&#x26;token=96a98062-2fb8-4208-8656-9e5ceb499683" alt=""><figcaption><p>Wireshark traffic</p></figcaption></figure>

Hmm, where is the flag? I tried to check the flag format and could see that the flag format is picoCTF{XXXXXX}, thus maybe the password is the flag value. I tried to put the password as a flag and boom, I solved it.

I thought that the password was used to extract more traffic data and then I could find the flag from there but it wasn’t true. Still learn much stuff regarding networking. Thanks to author MISTRESSVAMPY

## **Flag**

```json
picoCTF{mickeymouse}
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://thomasbui.gitbook.io/blog/software-security/ctfs-write-ups/writeups-picoctf-collection/picogym-exclusive/forensic-wpa-ing-out-200-pts.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.