Skills | Threat Intel & Forensics Portfolio

ASCWG QUALS • NETWORK FORENSICS • ICS PROTOCOL SMUGGLING

By Abdo•Aug 20, 2026

Challenge Prompt

“Our perimeter IDS flagged anomalous telemetry between industrial SCADA sensor controllers. Deep packet inspection indicates covert data exfiltration hiding inside legitimate TCP protocol header fields. Analyze the PCAP to reconstruct the leak.”

● Category: Network Forensics / Covert Channels● Platform: ASCWG Qualifications 2026● Flag Format: ASCWG{...}

Provided Artifacts

sensor_dump.pcap

Size: 94 MB • Packet CaptureProtocol: TCP Urgent Pointer (URG)

Analyzer: Wireshark / TShark / Scapy

In “Sensor Confession,” participants are thrown into a network forensics scenario involving anomalous traffic originating from industrial control sensors. The challenge required filtering through the noise of a massive PCAP file to find the specific protocol abuse used by the attacker to leak data.

💡 THE BEGINNER BREAKDOWN (The Smuggler's Truck Fleet)

Think of network traffic like cars driving on a busy highway. Most of the cars are just regular commuters (normal data). But if you look closely, you might notice a fleet of identical delivery trucks repeatedly driving by, and each truck has a single letter painted on its roof. If you write down the letters as the trucks pass by, they spell out a secret message! In this challenge, the attacker hid the stolen flag by splitting it into tiny pieces and smuggling it inside the “headers” (the roof) of normal-looking network packets.

Q: How was the flag exfiltrated from the sensor network?

A: Data Smuggling via Protocol Header Manipulation (TCP URG)

By utilizing Wireshark and tshark, we filtered out standard TCP handshakes and focused purely on anomalous packet lengths and malformed headers originating from the sensor subnet. The attacker was exploiting the TCP Urgent PointerA flag in the TCP header intended to prioritize data, rarely used today, making it perfect for stealthy data exfiltration. field—typically unused in modern networks—to slowly bleed the flag out over thousands of seemingly benign heartbeat packets, one byte at a time.

tshark_extraction.sh

$ tshark -r capture.pcap -Y "ip.src == 10.0.5.55 && tcp.urgent_pointer > 0" -T fields -e tcp.urgent_pointer | head -n 8

# Output (Hexadecimal values of ASCII chars):
41 // 'A'
53 // 'S'
43 // 'C'
57 // 'W'
47 // 'G'
7b // '{'
74 // 't'
33 // '3'

Automated Python Extractor (`extract_urg.py`):

import pyshark

# Extract TCP urgent pointer bytes across the sensor conversation
cap = pyshark.FileCapture('sensor_dump.pcap', display_filter='ip.src == 10.0.5.55 && tcp.urgent_pointer > 0')

flag_chars = []
for pkt in cap:
    try:
        urg_val = int(pkt.tcp.urgent_pointer)
        flag_chars.append(chr(urg_val))
    except AttributeError:
        continue

flag = ''.join(flag_chars)
print("🎉 Reconstructed Sensor Flag:", flag)

⚡ Terminal One-Liner (PowerShell / Bash):

tshark -r sensor_dump.pcap -Y "ip.src == 10.0.5.55 && tcp.urgent_pointer > 0" -T fields -e tcp.urgent_pointer | python -c "import sys; print(''.join([chr(int(x.strip(), 16)) for x in sys.stdin if x.strip()]))"

[ SHOW METHODOLOGY: Tshark Payload Extraction ]▼

Load the PCAP and run statistics on endpoint conversations.
Notice a high volume of packets communicating with an external IP on a non-standard port.
Use tshark -r capture.pcap -Y "ip.src == [SENSOR_IP]" -T fields -e tcp.urgent_pointer to extract the smuggled bytes.
Pipe the resulting hex stream into Python, convert to ASCII, and decode the final flag string.

The flag wasn't sitting in plain text in a single packet. It was fragmented across thousands of packets and smuggled within the TCP urgent pointer field. By extracting this specific field across the entire conversation stream, we rebuilt the original binary payload.

Final Submitted Flag:

ASCWG{t3l3m3try_s3ns0r_d4t4_l34k_v14_tcp}

Here is the step-by-step roadmap from initial PCAP conversation analysis to decoding the smuggled TCP stream:

STEP 1

Conversation Triage & IP Isolation

Ran Wireshark Statistics → Conversations. Filtered down to the suspicious SCADA telemetry stream originating from sensor IP 10.0.5.55.

STEP 2

Header Field Inspection

Payload appeared as encrypted heartbeat noise. Inspected TCP header fields and spotted non-zero tcp.urgent_pointer values matching valid printable ASCII hex codes.

STEP 3

TShark Extraction Filter

Crafted extraction filter ip.src == 10.0.5.55 && tcp.urgent_pointer > 0 to carve the sequential hex byte stream.

STEP 4

Stream Reassembly & Decoding

Piped extracted bytes into Python to assemble ASCII text: 41 53 43 57 47 ... → ASCWG{...}.

STEP 5

Flag Submission

Submitted recovered flag: ASCWG{t3l3m3try_s3ns0r_d4t4_l34k_v14_tcp}.

Stage 1: PCAP Triage & Protocol Analysis

💡 THE BEGINNER BREAKDOWN (The Smuggler's Truck Fleet)

Constructing the Final Flag

The Complete Investigation Path & Mental Roadmap