Edit lab

Editing ws-exfil-over-http

{
  "slug": "ws-exfil-over-http",
  "tags": [
    "wireshark",
    "mvp",
    "guided-lab"
  ],
  "flags": [
    {
      "key": "final",
      "value": "ZDL{ws-exfil-over-http}"
    }
  ],
  "hints": [
    {
      "id": "hint-1",
      "content": "Start with the most obvious metadata field before diving deeper.",
      "penaltyPoints": 0
    },
    {
      "id": "hint-2",
      "content": "Correlate timestamps, source identifiers, and the user-facing lure.",
      "penaltyPoints": 5
    }
  ],
  "title": "Simple Exfiltration Over HTTP",
  "runtime": {
    "mode": "docker_compose",
    "cpuLimit": 1,
    "exposePorts": [],
    "templateKey": "wireshark-pcap-lab",
    "memoryLimitMb": 512,
    "artifactsMountPath": "/lab/artifacts"
  },
  "summary": "Detect a basic exfiltration pattern using filters and streams.",
  "artifacts": [
    {
      "key": "primary",
      "path": "artifacts/ws-exfil-over-http.pcapng",
      "type": "pcap",
      "label": "Primary Lab Artifact",
      "downloadable": true
    }
  ],
  "questions": [
    {
      "key": "q1",
      "type": "short_text",
      "answer": "sample-indicator",
      "points": 10,
      "prompt": "What is the main indicator you identified first?",
      "caseSensitive": false
    },
    {
      "key": "q2",
      "type": "short_text",
      "answer": "isolate and escalate",
      "points": 10,
      "prompt": "What action should the analyst take next?",
      "caseSensitive": false
    },
    {
      "key": "flag-final",
      "type": "flag",
      "answer": "ZDL{ws-exfil-over-http}",
      "points": 20,
      "prompt": "Submit the final lab flag.",
      "caseSensitive": true
    }
  ],
  "trackSlug": "wireshark-fundamentals",
  "difficulty": "intermediate",
  "trackTitle": "Wireshark Fundamentals",
  "instructions": [
    {
      "id": "step-1",
      "title": "Review the scenario",
      "content": "Read the scenario summary and note the primary investigation goal."
    },
    {
      "id": "step-2",
      "title": "Inspect the provided artifact or environment",
      "content": "Use the artifact downloads or the live container session to gather evidence."
    },
    {
      "id": "step-3",
      "title": "Answer the guided questions",
      "content": "Submit answers and the final flag before time expires."
    }
  ],
  "estimatedMinutes": 20,
  "timeLimitMinutes": 30,
  "dbLabId": "74b06d2d-d17e-4f2a-806e-95474c08eb76"
}