Description
The attacker appears to have identified a web application running on our server. We need to determine what application was being targeted. Find the version and username associated with the application in the capture.
Download: pcap2.pcapng
Solution
Filter by HTTP. There are several CSS and js files that indicate the version. E.g.
login.min.css?ver=6.9user-profile.min.js?ver=6.9
For the username, one of the last HTTP packets is a GET request to:
/wordpress/index.php/author/kadmin_user/
The server returns a 200 OK and then the attacker tries to log in using that username (but the attempt fails).
Flag: KCTF{6.9_kadmin_user}