> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/forensics/pcap/webnet0.md).

# webnet0

**Goal:** Decrypt captured TLS traffic using a provided RSA private key to find the hidden flag.

**1. Import the RSA Key**

Open Wireshark and navigate to the RSA Key List settings:

* **Path:** `Edit` > `Preferences` > `Protocols` > `TLS`
* Locate the **RSA keys list** and click **Edit**.
* Click the **+ (plus)** icon to add a new entry.
* **Key File:** Click the folder icon to select your `.key` or `.pem` file.
* *Note: You can leave the IP Address and Port fields blank.*

**2. Locate the Decrypted Traffic**

Once the key is added, Wireshark will automatically decrypt the traffic.

* Look for packets now labeled with the **HTTP** protocol (previously hidden inside TLS).
* Right-click an HTTP packet and select **Follow** > **TLS Stream** or **HTTP Stream**.

**3. Find the Flag**

The flag is located within the HTTP response headers of the decrypted traffic.

> **Flag Found:** > `picoCTF{nongshim.shrimp.crackers}`

#### **Why this works**

Normally, TLS traffic is encrypted and unreadable. By providing Wireshark with the **RSA Private Key**, it can decrypt the session. Once decrypted, the "Application Data" is revealed as standard HTTP text, allowing you to see custom headers like `Pico-Flag`.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/forensics/pcap/webnet0.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.