WebNet0 picoCTF 2019 Solution

Published: April 2, 2026

Description

We found a packet capture and a key file. Decrypt the TLS traffic and recover the flag. Download both the pcap and the key.

Setup

Download the pcap file and the RSA private key file from the challenge page.

Open Wireshark.

Step 1Load the RSA key into Wireshark
In Wireshark, go to Edit > Preferences > Protocols > TLS (formerly SSL). Under RSA Keys, add the downloaded key file. Then close and re-open the pcap so Wireshark applies the decryption key.
Learn more
TLS encrypts network traffic using symmetric keys negotiated during a handshake. Wireshark can decrypt these sessions when given the server's RSA private key, because the private key decrypts the pre-master secret from the handshake, which derives all session keys. This only works with RSA key exchange, not DHE or ECDHE (ephemeral Diffie-Hellman), which generates session keys that the static private key cannot recover.
Step 2Follow TLS streams to find the flag
After adding the key, right-click on a TLS Application Data packet and select Follow > TLS Stream. Browse each stream for the flag - it appears in the HTTP response header of one of the conversations.
Learn more
Once Wireshark has the RSA private key, TLS Application Data decrypts to readable HTTP. Follow TLS Stream shows the full request and response in plaintext. Use Edit > Find Packet and search for 'picoCTF' in packet bytes to locate the relevant packet without examining each stream individually.
Packet captures combined with private keys are a powerful forensic tool. This is why forward secrecy (DHE/ECDHE key exchange) is strongly recommended - without forward secrecy, a leaked private key can decrypt all past recorded sessions.

picoCTF{...}

Wireshark decrypts TLS when the server RSA private key is provided - the flag is in an HTTP response header inside the encrypted stream.

Want more picoCTF 2019 writeups?