Hi CrzyAzn. If it's a computer forensics competition, I suppose you have to deal with some kind of .pcap file. If so, just open it with Wireshark, filter only HTTP requests (http.request) and look for a request that contains the "Authorization" header line. Once you found it, you will need to decode the base64 string that follows the "basic" (on the header line) to get the credentials.

gnix

ps: Wireshark has also a http.authbasic filter which should allow you to filter every basic HTTP authentication request. However, I've never had the opportunity to test this expression.