# ▼▼▼Missed Registration (Forensics:150)(143/1444 team=9.9%)▼▼▼
**This writeup is written by [@kazkiti_ctf](https://twitter.com/kazkiti_ctf)**

```
It's registration day! These forms just seem longer and longer...
UPDATE 10:44 Eastern: New pcap that should be a bit easier to work with.
UPDATE 2:58 Eastern: We're regenerating due to flag leaks, submissions disabled until then. Please be patient.
Update 3:31 Eastern: Updated pcap with new flag after leak. Please re-run your solutions on the file!
・cap.pcap file is given.
```

### 【Analytics】

・A lot of HTTP protocol are transmitted.

・it seems to be a **BMP file** because **the value of the x parameter** of the first request begins with **42 4d**.

### 【exploit】

Extract & combine the value of x parameter

↓

`$ strings cap.pcap | grep "x=" |sed 's/.*x=\([a-f0-9]*\).*/\1/' > test.txt`

`$ xxd -r -p test.txt test.bmp`

↓

**FLAG{3Am_LaunDR3Y_FL4G_L34kz!}**