Search a packet capture for flags

Worth doing first and worth doing last. First because a flag sitting in a plaintext payload costs one click to find, and last because after you have decrypted a TLS session or reassembled a transfer there is new plaintext to scan that was not there before.

What it looks for

The same prefix vocabulary the rest of the app uses - flag{...}, ctf{...}, an event's own prefix like HTB{...}, and the dashed FLAG-... form - matched against raw payload bytes rather than against decoded text. That distinction matters: a capture payload is arbitrary bytes, and a matcher that insists on a word boundary in front of the prefix misses a flag that happens to sit one byte after a length field.

When it comes back empty

• The flag is inside TLS. Get the key log and decrypt first.
• The flag is encoded - base64 in an HTTP body, hex in a DNS label, or spread across ICMP echo payloads one byte at a time.
• The flag is inside a transferred file rather than in the traffic. Recover the file, then run File mode over it.
• The prefix is one nothing has seen before. Search the packet list for { and read what is around it.