Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.jaspervanzeir.be/llms.txt

Use this file to discover all available pages before exploring further.

After reading the challenge description, my first logical step was to open the file (interception.wav) in an audio editor. I chose Audacity, as it’s the perfect tool to inspect frequencies and the audio spectrum. I started by simply listening to the audio fragment. At first glance, there was nothing weird or suspicious about the voice recording itself (apart from the Russian guy threatening me).

​
Enumeration & Analysis

Since the standard audio playback didn’t reveal anything, I decided to switch the view in Audacity to the Spectrogram. This visualizes the frequencies of the audio over time, which is a classic way to uncover hidden signals in these types of CTF challenges.
Https Files Gitbook Com V0 B Gitbook X Prod Appspot Com O Spaces%2fwf Uhrqei Mz Jnppiwss2r%2fuploads%2fi PBN Rr K46j16sipr E1um%2ftoggle Spectogram
As soon as I switched views, something immediately stood out. There were clearly two separate audio sources. The bottom, messy waveform was the human voice, but right above it, there was a very sharp, unnatural, blocky pattern running on the higher frequencies.
Https Files Gitbook Com V0 B Gitbook X Prod Appspot Com O Spaces%2fwf Uhrqei Mz Jnppiwss2r%2fuploads%2fl Hr O Zg Z Kg KR Hqo3dab Dj%2fspectogram

​
Decoding the Puzzle

It was obvious that this top, blocky pattern was the key. I looked at it closely, and my very first thought was:
This has to be Morse code.
I could clearly see short visual pulses followed by long ones, and vice versa. I tried to manually translate the pattern into dots and dashes, but I didn’t get far. I couldn’t make a consistent distinction between what was truly “long” and what was “short”, there were simply too many variations in between. Morse code was a dead end.

​
The Breakthrough: Binary Frequencies (FSK)

I took a step back and looked at the structure of the blocks again. Then it hit me: instead of focusing on the length of the pulses (like Morse), I needed to focus on the height of the frequencies. I noticed the signal was essentially just bouncing back and forth between exactly two levels:
  • A lower frequency at around 450Hz (which could represent a binary 0).
  • A higher frequency at around 900Hz (which could represent a binary 1).
Https Files Gitbook Com V0 B Gitbook X Prod Appspot Com O Spaces%2fwf Uhrqei Mz Jnppiwss2r%2fuploads%2f Vy N Mqc B7pk9i Bs6e Ix Fm%2fspectogram Horizontaal
Next, I looked at the timeline at the top of Audacity and realized that the blocks were perfectly divided into exact 100-millisecond (100ms) intervals.
Https Files Gitbook Com V0 B Gitbook X Prod Appspot Com O Spaces%2fwf Uhrqei Mz Jnppiwss2r%2fuploads%2fw Rrxg T Dr Aj G Zq B Rlh Yuh%2fspectogram Verticaal
This meant I could read the audio track as a binary string simply by checking which frequency the line was on every 100ms. The first short block at 450Hz would be a 0, followed by a jump to 900Hz for the next 100ms (a 1). After that, the line stayed at 450Hz for 400ms, resulting in four zeros (0000). I systematically worked through the entire 13.040-second audio file, logging the state every 100ms. This gave me the following complete binary sequence: 
010000110011010000100000010010010100111000100000010011000100111101000011001000000100001001010010010000010101011001001111

​
Extracting the Message

With a clean binary sequence in hand, it was time to decode it. I copied the sequence, opened CyberChef in my browser, and pasted it into the Input box. Because I wanted to see what it would decode to quickly, I used the Magic recipe. This is an incredibly useful feature in CyberChef that automatically detects and applies the most likely decoding operations (like Binary to ASCII).
Https Files Gitbook Com V0 B Gitbook X Prod Appspot Com O Spaces%2fwf Uhrqei Mz Jnppiwss2r%2fuploads%2f5mh Ojv Go N5j L7gpr FN Br%2fcyberchef
Instantly, the hidden message appeared in the Output field: C4 IN LOC BRAVO Given the expected flag format mentioned in the briefing (CySS{hidden message}), I wrapped the text, submitted it, and solved the challenge! Flag: CySS{C4 IN LOC BRAVO}

​
Tools Used

  • Audacity: Used the Spectrogram view for visual analysis of the audio spectrum and measuring frequency heights and time intervals.
  • CyberChef: Specifically used the “Magic” recipe to quickly translate the manually extracted binary string into readable ASCII text.

​
Summary

  • Key Steps: I analyzed a seemingly normal audio file using a spectrogram, discovered a hidden data channel on specific frequencies, and manually extracted a binary string by logging the frequency shifts every 100ms. I then decoded this data via CyberChef to reveal the flag.
  • What I Learned: This was an excellent introduction to Frequency Shift Keying (FSK) style modulation in audio steganography. Visualizing audio can expose hidden data layers that are completely undetectable to the human ear.
  • Crucial Mistakes/Takeaways: My initial instinct to immediately assume Morse code cost me some time. This was a valuable lesson: if a theory (like Morse) feels messy or inconsistent when applied, it’s crucial to take a step back and look for other patterns (like high/low frequencies and fixed time intervals) in the raw data.