This challenge offers a pcap file for download, and hints at a reference to Baby Shark, but not ever saying the word “shark”
What is a PCAP?
PCAP files are packet captures – files that show the network traffic seen from an interface. Every packet your computer sends, every HTTP request, every DNS query, every SYN, all of it is kept in packet captures. This makes PCAPs extremely valuable in forensics, if the network traffic is not encrypted, you can see exactly what the computer was doing at any time of the capture.
Baby (Wire)shark
As hinted in the flavor text, Wireshark is a common program used to view pcap files. By loading our pcap into wireshark, we see a single HTTP request and response.
Perhaps the website had some interesting information? Let’s look at the HTTP response. To do this, let’s right click the HTTP response and click “Follow HTTP Stream”.
Doing that, we see the full text of the request and response.
Viewing the HTTP response, we get the flag!