<commit_before>---
layout: single
title: "Magnet CTF Week 3 - Failed connections"
date: '2020-10-27T00:00:00+09:00'
author: "<NAME>"
tags:
  - infosec
  - dfir
  - CTF
  - Magnet
modified_time: ""
---
Magnet Forensics is running a *weekly* forensic CTF. More information can be found on their [blog](https://www.magnetforensics.com/blog/magnet-weekly-ctf-challenge/). It is a fun way to practice, so let's get to it!

### CTF Posts

[Week 1](https://dfir.science/2020/10/Magnet-CTF-Week-1-Timestamps-of-doom.html) | [Week 2](https://dfir.science/2020/10/Magnet-CTF-Week-2-URLs-in-Pictures-in-Pictures.html) | [Week 3](https://dfir.science/2020/10/Magnet-CTF-Week-3-Failed-connections.html)

### Getting Started

Download the Android data from [here](https://drive.google.com/file/d/1tVTppe4-3Hykug7NrOJrBJT4OXuNOiDO/view?usp=sharing). Note that the data was released October 5th, 2020 @ 11AM ET.

Calculate the hash of the suspect data:
```bash
sha1sum MUS_Android.tar 
10cc6d43edae77e7a85b77b46a294fc8a05e731d  MUS_Android.tar
```

Week 3 question:

> Which exit did the device user pass by that could have been taken for Cargo?

OK, so this week we have a bit of a riddle. Two things we don't know are "what is exit" and "what is Cargo"? We might be looking for a highway exit, subway exit, bus station exit. Cargo might be the cargo like you ship, but then why would it be capitalized? Possibly the name of a location?
<commit_msg>title change because it's awesome<commit_after>---
layout: single
title: "Magnet CTF Week 3 - The case of the spoiled S. Cargo"
date: '2020-10-27T00:00:00+09:00'
author: "<NAME>"
tags:
  - infosec
  - dfir
  - CTF
  - Magnet
modified_time: ""
---
Magnet Forensics is running a *weekly* forensic CTF. More information can be found on their [blog](https://www.magnetforensics.com/blog/magnet-weekly-ctf-challenge/). It is a fun way to practice, so let's get to it!

### CTF Posts

[Week 1](https://dfir.science/2020/10/Magnet-CTF-Week-1-Timestamps-of-doom.html) | [Week 2](https://dfir.science/2020/10/Magnet-CTF-Week-2-URLs-in-Pictures-in-Pictures.html) | [Week 3](https://dfir.science/2020/10/Magnet-CTF-Week-3-Failed-connections.html)

### Getting Started

Download the Android data from [here](https://drive.google.com/file/d/1tVTppe4-3Hykug7NrOJrBJT4OXuNOiDO/view?usp=sharing). Note that the data was released October 5th, 2020 @ 11AM ET.

Calculate the hash of the suspect data:
```bash
sha1sum MUS_Android.tar 
10cc6d43edae77e7a85b77b46a294fc8a05e731d  MUS_Android.tar
```

Week 3 question:

> Which exit did the device user pass by that could have been taken for Cargo?

OK, so this week we have a bit of a riddle. Two things we don't know are "what is exit" and "what is Cargo"? We might be looking for a highway exit, subway exit, bus station exit. Cargo might be the cargo like you ship, but then why would it be capitalized? Possibly the name of a location?

{'fraction_non_alphanumeric': 0.11578221915920055, 'fraction_numerical': 0.05513439007580979, 'mean_word_length': 4.174688057040998, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 7, 'https://': 10, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1788542', 'n_tokens_mistral': 1162, 'n_tokens_neox': 1034, 'n_words': 335}