> For the complete documentation index, see [llms.txt](https://doubtfulturnip.gitbook.io/dts-cybersecurity-tool-kit/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doubtfulturnip.gitbook.io/dts-cybersecurity-tool-kit/ctf-archive/csc-ctf-2020-write-ups/guess-what.md).

# Guess What

Open the 'guesswhat.pcapng' file in wireshark.Select File>Export Objects>HTTP.Sort by 'Filename'.Save the 'hahaha.zip' as shown.

![](https://783013645-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMm6ZgPSCgprStuXBm3%2F-MMt5oLgixOJE1Mf2oPo%2F-MMt6jlol5924-tLtdU7%2Fimage.png?alt=media\&token=dd08fe0d-db5e-4eaa-92af-d563a63e2d72)

Extract the files within the compressed archive.Open 'nyc.jpg' in a text editor to reveal additional data.

![](https://783013645-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMm6ZgPSCgprStuXBm3%2F-MMt5oLgixOJE1Mf2oPo%2F-MMt6xbkXU7MGnLB_0ib%2Fimage.png?alt=media\&token=af76ad0a-528f-4454-abc5-6f80177eb4b4)

Download and install a stego tool called 'Outguess'.

{% embed url="<https://github.com/resurrecting-open-source-projects/outguess>" %}

View the included config files.

![](https://783013645-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMm6ZgPSCgprStuXBm3%2F-MMt5oLgixOJE1Mf2oPo%2F-MMt7C-73MKC3u03CL7K%2Fimage.png?alt=media\&token=7376e040-0103-401b-a2a7-78b715878486)

Prepare the OutGuess library for installation.

![](https://783013645-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMm6ZgPSCgprStuXBm3%2F-MMt5oLgixOJE1Mf2oPo%2F-MMt7KAZQ3USvpY7MShq%2Fimage.png?alt=media\&token=52a7ca7e-71ef-4dd1-b899-d3642a31022f)

Run OutGuess against the 'nyc.jpg' file and output the result. The -r flag is needed in order to read stego in a file, by default OutGuess will apply stego to a file.

![](https://783013645-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MMm6ZgPSCgprStuXBm3%2F-MMt5oLgixOJE1Mf2oPo%2F-MMtCxfR7ihP729Ix7E_%2Fimage.png?alt=media\&token=b7c857cf-84b5-47a8-9b24-8fdf44e52e50)

Concatenate the output file to show any stego pulled out of the file and obtain the flag.