initial commit

traffic-analysis/return-to-sender/README.md

@@ -0,0 +1,22 @@
+# Return to Sender
+
+**Category:** Traffic Analysis
+
+**Points:** 80
+
+## Description
+
+\<iframe src="" style="background-image: url('https://deadface.sfo3.cdn.digitaloceanspaces.com/2026/img/wayfinder/return_to_sender.png');background-size:cover;background-position:center center;background-origin:content-box;background-repeat:no-repeat;background-color:rgba(40, 40, 40,0);min-height:80px;height:130px;width:100%;padding:10px;border:none" title="Thumbnail">\</iframe>
+\<sup>Created By: \<code>@RP-01?\</code>\</sup>
+
+Something on this network is stealing data and sneaking it out disguised as ordinary web traffic. You've been handed a packet capture from the affected machine. Buried, a compromised host is quietly shipping stolen data out to a server it shouldn't be talking to. Find the traffic that doesn't belong, figure out what's being smuggled, and piece it back together.
+
+Submit the flag as `deadface{flag_text}`.
+
+## Services
+
+- [https://deadface.sfo3.cdn.digitaloceanspaces.com](https://deadface.sfo3.cdn.digitaloceanspaces.com)
+
+## Attachments
+
+- [PCAP03.pcap](files/PCAP03.pcap)