Hacker Holidays 2026: Day 4 Walkthrough (Packed Light)

This is Day 4 of my Hacker Holidays 2026 walkthrough series. Day 0 was OSINT. Day 1 was AI prompt injection. Day 2 was an exposed .git directory. Day 3 was AWS cloud misconfiguration.

Today, we shift into network forensics. We are given a packet capture file and tasked with finding a covert communication channel, reassembling exfiltrated data hidden inside HTTP cookies and decoding the final message to retrieve the flag.

This is my favorite challenge of the series so far. Let us break it down.

The Setup

The challenge gives us a clear itinerary:

Analyze the provided capture for a covert communication channel.
Identify where the exfiltrated data is being hidden and reassemble it.
Decode the recovered data and submit the flag.

We download the task files and receive a traffic.pcapng file. Time to open it in Wireshark.

Step 1: Filter the Traffic

A raw packet capture can contain thousands of packets across dozens of protocols. We need to narrow our focus.

The challenge hints tell us that a laptop was "pinging an address every single second like clockwork" and that the data is hidden in "request headers." This strongly suggests HTTP traffic on a non-standard port.

In Wireshark's display filter bar, we apply:

tcp.dstport == 8080 and http

tcp.dstport == 8080 and http

This filters the capture down to only HTTP traffic destined for port 8080. The noise disappears and we are left with a clean set of HTTP requests sent at regular one-second intervals.

Step 2: Identify the Covert Channel

Examining the filtered HTTP requests, we look at the headers of each packet. One field immediately stands out: the Cookie header.

Each request contains a cookie with the name hotel_sess_state followed by a short Base64-encoded value. The values change with every request.

This is the covert channel. Someone (or something) is exfiltrating data by splitting it into small chunks and hiding each chunk inside the cookie header of periodic HTTP requests. To a casual observer or a basic intrusion detection system, these look like normal session cookies. But they are actually fragments of a hidden message.

The data is not in one packet. It is spread across all of them. We need to extract every single cookie value and reconstruct the original message.

To make the cookie values visible at a glance, we can add them as a column in Wireshark:

Expand any HTTP request's headers in the packet details pane.
Find the Cookie header line.
Right-click on it and select Apply as Column.

A new column appears at the top of Wireshark showing the cookie value for every packet. This makes it much easier to visually confirm that the values are indeed changing with each request.

But we need these values in a text file for processing. We have two options:

Option A: Using tshark (command line)

tshark -r traffic.pcapng -Y "http.cookie" -T fields -e http.cookie > cookies.txt

tshark -r traffic.pcapng -Y "http.cookie" -T fields -e http.cookie > cookies.txt

This extracts only the cookie field from every matching packet and saves it to a file.

Option B: Using Wireshark GUI

Go to File > Export Packet Dissections > As CSV and save the file. Open it in a spreadsheet to isolate the cookie column.

Step 4: Clean the Data

The extracted cookie values look like this:

hotel_sess_state=HA==
hotel_sess_state=AA==
hotel_sess_state=BQ==
hotel_sess_state=Mw==
...

hotel_sess_state=HA==
hotel_sess_state=AA==
hotel_sess_state=BQ==
hotel_sess_state=Mw==
...

We need to strip away the hotel_sess_state= prefix and keep only the Base64-encoded data chunks. You can do this with a simple find-and-replace in any text editor or spreadsheet.

After cleaning, we are left with the raw values:

HA==
AA==
BQ==
Mw==
Hg==
ew==
Og==
...

HA==
AA==
BQ==
Mw==
Hg==
ew==
Og==
...

Step 5: Combine the Fragments

Now we concatenate all the Base64 chunks into a single continuous string:

HA==AA==BQ==Mw==Hg==ew==Og==fA==Fw==eQ==Ow==Fw==Pw==fA==PA==Kw==IA==eQ==Jg==Lw==Fw==eA==Pg==LQ==Gg==Fw==MQ==eA==PQ==NQ==

HA==AA==BQ==Mw==Hg==ew==Og==fA==Fw==eQ==Ow==Fw==Pw==fA==PA==Kw==IA==eQ==Jg==Lw==Fw==eA==Pg==LQ==Gg==Fw==MQ==eA==PQ==NQ==

This is the complete exfiltrated message, still encoded and encrypted.

Step 6: Decode with CyberChef

The combined string is Base64-encoded. But simply decoding it from Base64 does not produce readable text. The data has been XOR-encrypted before being Base64-encoded.

We need to figure out the XOR key. Here is the clever part.

We know that TryHackMe flags always start with THM{. The letter "T" has a hex value of 0x54. When we decode the first Base64 chunk (HA==), we get the hex value 0x1C.

If the original plaintext byte is 0x54 (the letter "T") and the encrypted byte is 0x1C, then:

0x54 XOR 0x1C = 0x48

0x54 XOR 0x1C = 0x48

The XOR key is 0x48.

Now we apply both operations in CyberChef:

Paste the combined Base64 string into the Input field.
Add the From Base64 recipe.
Add the XOR recipe below it.
Set the Key format to Hex and enter 48 as the key.

The output reveals the flag:

THM{V3r4_1s_w4tch1ng_0veR_y0u}

THM{V3r4_1s_w4tch1ng_0veR_y0u}

Challenge complete.

What This Challenge Actually Teaches

This challenge demonstrates a real-world data exfiltration technique that advanced threat actors use in production environments. Let us break down why this matters.

Covert Channels in HTTP Headers. Malware frequently hides exfiltrated data in HTTP headers (cookies, user-agent strings, custom headers) because HTTP traffic is almost never blocked by firewalls. To most monitoring tools, a cookie that changes every request looks like normal session management. Security teams need to look for anomalous patterns like fixed-interval requests with rotating cookie values.

Data Fragmentation. By splitting the stolen data across hundreds of small packets, the attacker ensures that no single packet contains enough information to trigger an alert. Each individual cookie value is just a few bytes of seemingly random Base64. Only when reassembled does the data become meaningful.

Layered Encoding. The data was first XOR-encrypted and then Base64-encoded. This is a common pattern in malware communication. Base64 makes binary data safe for HTTP transport. The XOR layer prevents simple Base64 decoding from revealing the payload. Together, they create a lightweight but effective obfuscation scheme.

XOR Key Recovery. In this challenge, we recovered the key using a known-plaintext attack. Because we knew the flag format starts with "THM{", we could XOR the expected plaintext against the ciphertext to derive the key. This is why XOR with a single-byte key is never considered secure encryption. If an attacker knows even a single byte of the plaintext, the entire key is compromised.

The Answer

What is the flag?

THM{V3r4_1s_w4tch1ng_0veR_y0u}

What is Next

Day 4 took us deep into network forensics, packet analysis and cryptographic decoding. The challenges are getting progressively more complex and more realistic.

Stay tuned for Day 5.

If this brought value then consider supporting or sponsoring. Follow the journey on X, Instagram ,Github or Youtube

Contents

Someone was smuggling data out of the resort network one cookie at a time. We used Wireshark, Base64 and a single XOR key to decode the entire exfiltration.