Data Exfiltration Over HTTP: Find the Upload in a PCAP
Your network detection tool raised a low-priority alert overnight: unusually high outbound volume from a finance workstation, well after the office had emptied. The sensor kept a short capture around the alert, and you have it.
The office network is 10.40.12.0/24 and its clocks run on UTC, so the times in the capture are local office time. Everything in this file is synthetic: documentation IP ranges, .example names and a "file" made of filler text.
What you will find in the capture
- Ordinary background: ARP, DNS, an encrypted update check and a short intranet visit
- One HTTP conversation that is far larger than everything around it
- The server’s answer to that conversation, and what it says it kept
Data Exfiltration Over HTTP: Find the Upload in a PCAP
Your network detection tool raised a low-priority alert overnight: unusually high outbound volume from a finance workstation, well after the office had emptied. The sensor kept a short capture around the alert, and you have it.
The office network is 10.40.12.0/24 and its clocks run on UTC, so the times in the capture are local office time. Everything in this file is synthetic: documentation IP ranges, .example names and a "file" made of filler text.
You will practise
- Find an upload by method and size instead of reading every packet
- Read a multipart/form-data request: boundary, field name and file name
- Estimate how much data left a host from TCP payload lengths
- Use timing and destination as evidence, not just content
- Scope a possible data-theft incident and decide what to do first
8 questions. Each hint costs 25% of that question’s points; a wrong try costs a little. Your score is out of 100.
Loading the capture…
Loading…
Sample report · illustrative data
Sample result: Cleartext HTTP Login case
Example run of the starter case on a synthetic capture (documentation and private IP ranges, .example names, a made-up account).
Scoring
- Score
- 82/100 (example)
- Grade
- B, solid analysis
- Hints used
- 2 (example)
- Time
- 6m 40s (example)
Findings in the example run
| Question | Filter that finds it | Read |
|---|---|---|
| Where is the login submitted? | http.request.method == "POST" | One POST to the intranet over port 80 |
| What crossed the wire? | http.file_data contains "username=" | Username and password readable as typed |
| Did it work? | http.response.code == 302 | Redirect plus a session cookie without Secure |
Recommended next steps (example)
- Serve the intranet over HTTPS only, with HSTS and Secure cookies
- Reset the exposed password and end the account's sessions
- Search wider captures for other cleartext logins
Made-up example data. Your own run uses your inputs. Downloads of the full report need Pro.
Downloads
Take the capture into Wireshark or your own tools, and keep the analyst report with the answer key.
254.2 kB · 289 packets · SHA-256 59e48c696b580e2c0fe70354e89b7bcf9d62397248c01ade165a000038c13aa3
Sample of the debrief
This capture shows a finance workstation uploading a single large archive to an external file-drop host late at night, over plain HTTP, after a few minutes of ordinary activity. The server confirms it stored the file. That pattern, a first-seen destination, a large outbound transfer and an odd hour, is how many data-theft cases first show up on the network.
The full debrief, with next steps and the MITRE ATT&CK mapping, appears when you finish the case.
What you will learn
- Find an upload by method and size instead of reading every packet
- Read a multipart/form-data request: boundary, field name and file name
- Estimate how much data left a host from TCP payload lengths
- Use timing and destination as evidence, not just content
- Scope a possible data-theft incident and decide what to do first
Frequently asked questions
How do you find data exfiltration in a PCAP?
Look for volume and direction first: Statistics > Conversations sorted by bytes shows which host sent the most out. Then filter uploads with http.request.method == "POST" (or PUT) and check the destination, the time and the server’s response.
How do you see how much data was uploaded in Wireshark?
Read the Content-Length header of the request for the body size, or use Statistics > Conversations and read the bytes sent from the client to the server. Summing tcp.len for the client side of the stream gives the same answer.
How do you find the file name in an HTTP upload?
Multipart form uploads carry a Content-Disposition line with filename="..." at the start of each file part. Follow TCP Stream on the POST, or filter http.file_data contains "filename=".
Why is only one packet shown as HTTP?
The upload is larger than one TCP segment. The first segment carries the HTTP headers; the rest is the body continuing as TCP payload. Wireshark reassembles it by default; this lab’s viewer shows each segment as it is.
Is this real traffic?
No. PlayCISO generated it from a fixed seed with documentation IP ranges, .example names and locally administered MAC addresses. The archive is filler text, not a real file.