In the packet details, find the field (a 20-byte/40-character hex string). 3. Identify the Filename

: Looking for the filename directly in the PCAP; it is usually only found by resolving the hash externally. picoCTF 2022 Write-up: TorrentAnalyze | by Nisarg Suthar

In the case of the or similar naming conventions, the hash will lead you to the metadata containing the original filename, such as DODI_REPACKS_IT.torrent or the specific software name. 4. Technical Summary Protocol : BitTorrent (P2P) Key Identifier : info_hash (SHA1)