Simple PCAP

Goal: Can you spot the activity

I opened this PCAP file in Wireshark.

There was some activity going on in the TCP stream. I saw a PNG file being travelled.

I extracted this using the following option:

I saved the multipart/form-data 33 byte packet but it didn't work.

Then I observed the file being travelled in parts. I picked the specific PNG part in the wireshark explorer

And then exported the bytes this like this and saved it as PNG file:

The PNG had a flag!