Wireshark: Uncovering HTTP Response Headers in Network Traffic Analysis

As part of a comprehensive network forensics investigation, understanding how applications interact with each other on the network level is crucial. In this article, we'll explore how to use Wireshark to analyze HTTP response headers in Slack's network traffic.

When starting an analysis, it's essential to identify the relevant packets. By filtering for HTTP requests containing 'slack' in the host header field, we can narrow down our search and focus on packets specifically related to Slack's communication. This approach allows us to isolate the relevant data and better understand how Slack operates at the network level.

Once we've identified the relevant packets, we can use Wireshark's Follow HTTP Stream option (Stream #27) to read the exchange between the client and server more easily. This feature enables us to view the HTTP request headers, including any flags inserted into the server response headers. By examining these headers, we can gain valuable insights into Slack's communication patterns.

However, when dealing with encrypted traffic, such as TLS, additional steps are necessary to decrypt the data. Fortunately, Wireshark provides a helpful feature for this purpose – decryption using the Pre-Master Secret. This secret is often included in the challenge PCAP files, allowing us to decrypt the traffic and filter for specific packets.

In our analysis, we can use this decrypted traffic to identify packets related to the web server in question by filtering for http.host = ''. By doing so, we can focus on the relevant packets and extract valuable information about Slack's communication with the server.

Before diving into the analysis, it's essential to decrypt the encrypted traffic. Wireshark allows us to do this by supplying the Pre-Master Secret included in the secret-sauce.txt file provided with the challenge PCAPs. Only after decrypting the traffic can we start answering questions about Slack's network behavior.

This write-up is part of a series covering the network forensics section of the Spring 2020 DFIR CTF, released by the Champlain College Digital Forensics Association and the Champlain Cyber Security Club in May 2020. The challenge included various PCAP files related to Windows, MacOS, Apple iOS images, network traffic analysis, OSINT, and reversing challenges.

In conclusion, Wireshark is a powerful tool for network forensics investigations. By using its features to filter and decrypt HTTP response headers, we can gain valuable insights into Slack's communication patterns on the network level. As we continue our analysis, we'll explore more aspects of the Spring 2020 DFIR CTF and uncover the secrets hidden in the PCAP files.

Wireshark http response header