Shipping Manifest Pivot

Network capture carrying an HTTP response with a CSV fleet roster. One roster row hides a base64 flag in its notes field instead of a normal comment.

Solve

1. List the HTTP traffic and find the CSV transfer (server is LFMServer/3.2 (Lakefront Fleet Manager)):

tshark -r wabash.pcap -Y http

The CSV is fetched via GET /api/v1/personnel/crew_manifests_q2_2026.csv (200, text/csv). 2. That request/response lives in TCP stream 4. Follow it to dump the CSV body:

tshark -r wabash.pcap -q -z follow,tcp,ascii,4

3. Scan the notes column (last field). Every normal row has a short note like STCW current or an empty field. One row carries a base64 blob instead: vessel WAB-2207, crew member Jonas Tolliver (Master, Charter Liaison):

WAB-2207,BR9X2E,Jonas,Tolliver,Master,Charter Liaison,2026-02-14,U1ZJVVNDR3t3YWJhc2hfZmlud3NfcGl2b3RfbmFzX21hcml0aW1lXzAxfQ==

To pull it directly:

tshark -r wabash.pcap -q -z follow,tcp,ascii,4 | grep -oE 'U1ZJVVND[A-Za-z0-9+/=]+'

4. Decode it:

echo -n "U1ZJVVNDR3t3YWJhc2hfZmlud3NfcGl2b3RfbmFzX21hcml0aW1lXzAxfQ==" | base64 -d

Flag: SVIUSCG{wabash_finws_pivot_nas_maritime_01}