# World Wide CTF W/U
## Too Hidden


Ok, here we have a file `chall.pcapng`. *Wireshark time!*


Right away, we see a bunch of ICMP packets, aka Ping. Looking closely, we notice that the packets are almost identical except for the transmitted data.


At a glance, it looks like ASCII. By collecting all the packet data and converting it to text, we get:


...yep, it's `Morse Code`.


**Flag: WWF{HOLY_SHEEET_YOU_CAN_FIND_ME_?????????}**

## Forgot Password

The challenge provides `Evidence.ad1`. Based on the file extension, it's clear that we need to use **FTK Imager**.


Based on the given clue *'security question'*, it seems we need to find the security question set during Windows installation. At this stage, we can use RegRipper, but for convenience, I used a tool from [NirSoft](https://www.nirsoft.net/utils/security_questions_view.html).

**W NirSoft**



Ta da!!!


**Flag: WWF{I_love_security_questions_s0_muChhhhhhhhhhhhhh}**

# Conclusion
> It's just a journal because if a noob writes a write-up, people will laugh a lot.