# WhiteHat Challenge 03 : For001

**Category:** For
**Points:** 15
**Solves:**
**Description:**

> This piece of data is captured via USB port, look for the flag transferred through it.
>
> You can use Wireshark to read the file pcapng.
> Download file pcap here:
> http://material.wargame.whitehat.vn/challenges/3/For001_61fb3e6d8aa22c75362af02e798331bbf5b73a4b.zip
>
> Submit WhiteHat{sha1(flag)}
> Example: flag = Hello World
> sha1("Hello World") = 0a4d55a8d778e5022fab701977c5d840bbc486d0
> submit: WhiteHat{0a4d55a8d778e5022fab701977c5d840bbc486d0}
> (all hash characters in lowercase)

## Write-up

use Wireshark can export a zip fie, open it we get the flag.

## Other write-ups and resources
* [Kole and Associates](https://gospelofmark.ch/whitehat-challenge-03-for001-forensics.html)

Original writeup (https://github.com/mx9mx9/writeups-2017/tree/master/WhiteHat-2017-Challenge-03/For/For001).