# PCAP Investigation (CTF challenge)

> Host WKS-04 is beaconing out. A packet capture was pulled from the wire — download capture.pcap and work out how data is leaving the network, then reconstruct what was exfiltrated.

Canonical: https://codelivly.com/ctf/challenges/pcap-investigation

| | |
|---|---|
| Category | Forensics & OSINT |
| Difficulty | Medium |
| Points | 800 |
| Estimated time | 35 min |
| Type | Live instance |
| Solves | 48 |
| Author | Codelivly |

Host WKS-04 is beaconing out. A packet capture was pulled from the wire — download capture.pcap and work out how data is leaving the network, then reconstruct what was exfiltrated. The capture is unique to your instance. Tools: Wireshark, tshark, or scapy.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)