Rating:
In this question we are provided with a Wireshark Capture file named usbforensics.pcapng.
It is a capture of USB protocol. Generally in a usb dump we find keyboard interrupts or
mouse clicks as user input data, so I started searching for any packet containing info
about what type of data this dump contains.
After a while I got Get Response packet of a Device:
You can see idProduct is Keyboard, by this I know this capture is storing the data of
keyboard interrupts.
Now only thing left to do is to analyse the URB_INTERRUPT IN packets particularly whose
source is 7.16.1 which is most probably device IP and destination is host.
After observing I got to know the desired packets have frame length 66, so I applied a filter
for the same:
usb.transfer_type == 0x01 and frame.len==66 and !(usb.capdata == 00:00:00:00:00:00:00:00)
Now in every alternate packet I found HID Data:
Following this I got the whole flag:
```FLAG: VishwaCTF{n0w_y0u_423_d0n3_w17h_u58_f023n51c5}```
