Tag: DFIR
All posts tagged with "DFIR"
Portobello-53-Anger (2/2)
Part 1 - Version 1 3232::3 had base64 encoded strings. After decoding, found a flag. ID3 is the magic number for MP3 files, but can’t get it to …
Portobello-53-Bargaining
Packet Analysis Within your method of looking through the packets (using Wireshark), searching for the word flag- brought me directly to the flag. …
Portobello-53-Depression
Part 1 – PunnyCode After noticing multiple xn-- CNAMES in the PCAP, I narrowed down to host 9 and observed many of these entries. After removing the …