How to solve MarketDump [HackTheBox]

Step by step on how to solve this Forensics challenge. To can check it here.

We get a pcapng file, which we can open with Wireshark.

The clues in the problem tell us that an attacker used the webserver to pivot into the network. Reviewing the data we see that 10.0.2.3 is the server and 10.0.2.15 the client (you can get this by reviewing the requests and responses between…