Security Footage — THM Writeup

Security Footage is a network forensics challenge: we start from a traffic capture (.pcap) that holds the lost feed of a security camera. The goal is to carve the JPEG frames streamed over the network, rebuild the video with ffmpeg, and find the flag hidden in one of the scenes.

Platform	TryHackMe
Category	Blue Team & SOC — Forensics / Packet Analysis / File Carving
Difficulty	Medium
Room	Security Footage

Process map

[.pcap]  raw traffic capture
   │  Wireshark → identify the MJPEG stream (HTTP or raw TCP)
   ▼
[foremost]  magic-byte carving → FF D8 FF … FF D9 → JPEG frames
   │  ls -1v + rename → frame_0001.jpg, frame_0002.jpg, …
   ▼
[ffmpeg]  frame_%04d.jpg → reconstructed.mp4 (H.264)
   │  frame-by-frame review
   ▼
[FLAG]  hidden in a single frame of the reconstructed footage

Security Footage es un reto de análisis forense de red: partimos de una captura de tráfico (.pcap) que contiene el feed perdido de una cámara de seguridad. El objetivo es tallar (carve) los fotogramas JPEG transmitidos por la red, reconstruir el vídeo con ffmpeg y localizar la flag oculta en una de las escenas.

Plataforma	TryHackMe
Categoría	Blue Team & SOC — Forensics / Packet Analysis / File Carving
Dificultad	Medium
Room	Security Footage

Mapa del proceso

[.pcap]  captura de tráfico en bruto
   │  Wireshark → identificar el stream MJPEG (HTTP o TCP en crudo)
   ▼
[foremost]  carving por magic bytes → FF D8 FF … FF D9 → fotogramas JPEG
   │  ls -1v + renombrado → frame_0001.jpg, frame_0002.jpg, …
   ▼
[ffmpeg]  frame_%04d.jpg → reconstructed.mp4 (H.264)
   │  revisión fotograma a fotograma
   ▼
[FLAG]  oculta en un único fotograma del vídeo reconstruido

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.