Network capture the flag

Classroom resources

Load these into Waypoints Prepare: choose Load URL and paste the copied address, or download the file and import it. In Prepare, the worksheet's Teacher edition shows the answers; the student copy hides them.

• Slides Download Copy address for Prepare Present from the browser, or export to PowerPoint or PDF.
• Worksheet Download Copy address for Prepare Print the student copy; the Teacher edition has the answers.

Students will be able to

• I can find which data on a network anyone could read.
• I can use packet numbers to rebuild a message and find a missing packet.
• I can find a route round a busy router and say how to fix readable traffic.

Timing

Engage 3 min · Explore (flags) 25 min · Explain 5 min · Elaborate 7 min · Evaluate 5 min

Before class

Try each flag yourself. Everything is made up and runs on the board.

Flags (for you, not students): 1 WP{plain-text-is-public} (the Room 12 display's packet), 2 WP{numbers-put-it-back} (packets in number order), 3 WP{resend-11}, 4 WP{ABDGH} (19 ms; through E is 12 ms but loses packets).

Format: like most capture-the-flag events (picoCTF among them), each student works alone and only the score is shared. To run it as a class event, pairs race to four flags and you keep score.

Rules of the game: only capture traffic on a network you own or have permission to check, as here. Real tools (such as Wireshark) capture packets the same way; using them on networks you don't own is against school rules and the law.

Simplifications: the capture shows one packet per device; real captures show thousands. A Wi-Fi password does encrypt the radio link from each device to the router (WPA2/WPA3), but others with the password are on the same network, and past the router the data crosses the internet, so HTTPS is what protects it end to end.

Running the lesson

1. Engage: ask what the Wi-Fi password protects, and from whom.
2. Explore: circulate; ask which lesson's idea each flag needs before giving a hint.
3. Explain: name the idea behind each flag together.
4. Elaborate: ask why sending updates at night isn't a fix.
5. Evaluate: discuss what to check before using a café's Wi-Fi.

The hard part (on purpose)

Flag 4: students take the first route that reaches H. Ask them to list every route that avoids E and add up each one.

When students get stuck

Answers to the checks

1. Engage: who can see it?: A device on the club Wi-Fi sends a message without HTTPS. Who could read it?
   Anyone on the network or along the way who captures it. Only encryption all the way (HTTPS) keeps it private.
2. Flag 1: the capture: Flag 1 (who can see your data?). This capture shows what anyone on the club Wi-Fi could pick up. One readable packet holds the flag.
   A flag (the exact answer is in the teacher notes)
   The Room 12 display sends plain text. The HTTPS packets were scrambled for everyone but the device and its site.
3. Flag 2: out of order: Flag 2 (packets). A message from the club server arrived out of order. Put the packets back in order and read it.
   A flag (the exact answer is in the teacher notes)
   The numbers let the receiver rebuild the message whatever order the packets arrive in.
4. Flag 3: the lost packet: Flag 3 (TCP). One packet of the backup never arrived. Which one must TCP ask for again? The flag is WP{resend- then its number, then }.
   A flag (the exact answer is in the teacher notes)
   Packet 11. Because packets are numbered, TCP can ask for just the missing one, not the whole backup.
5. Flag 4: the route: Flag 4 (routes). Find the quickest route from A to H that avoids the overloaded router E. The flag is WP{ then the routers' letters in order, then }.
   A flag (the exact answer is in the teacher notes)
   A, B, D, G, H: 19 ms. Routes through E are quicker on paper (12 ms) but lose packets; routers send traffic round trouble the same way.
6. Explain: what the flags show: Sam checks the club network. Click the line where it first goes wrong.
   line 3
   Line 3: everyone with the password is on the network too, and past the router the data travels the internet. Only HTTPS protects it all the way.
7. Elaborate: fix the network: Fix every club device that sends readable data.
   
   Encrypted printing, HTTPS for the display and an encrypted camera stream: the capture now shows nothing anyone can read.
8. The café: You're on a café's free Wi-Fi. Which is safe to do?
   Use sites with HTTPS (the padlock): what you send is encrypted all the way
   HTTPS encrypts from your device to the site, whoever else is on the network.

Solutions

One possible solution for each task. Other correct programs are fine.

Elaborate: fix the network

Open task: any program that does what the step asks.

Stretch and support

Stretch: Change the map: if the link from D to G became 15 ms, which route would you use? Work it out, then design your own map with a busy router and a unique best route.

Support: A card with the four ideas: encryption, packet numbers, TCP resends, routes.

Exit ticket

Why do packets carry numbers? Give two reasons.

So the receiver can put them back in order, and so it can tell which one is missing and ask for just that one (TCP).

What each step is for

• Engage: who can see it?: Committing to what others on a shared Wi-Fi can pick up frames the hunt: unencrypted data is readable to anyone on the network.
• Explore: four flags: Each flag needs one idea from the course applied to the club's traffic; the hints escalate and never give the flag.
• Explain: what the flags show: Naming the idea behind each flag; Sam trusts the Wi-Fi password, the misconception planted after the method.
• Elaborate: fix the network: Ending a CTF the way defenders do: every readable device is fixed, and the wrong fixes only make it seem safer.

Where it leads

End of the course. Capture the flag (Digital systems) and Security and privacy have more.