FlagSniff is a powerful command-line tool designed for red teamers and CTF players to quickly analyze .pcap files and extract flags, credentials, tokens, and other sensitive information.
- 📁 PCAP & PCAPNG File Analysis: Load and parse
.pcap or .pcapngfiles using Scapy - 🔍 Multi-Protocol Support: HTTP, DNS, FTP, Telnet, TCP, UDP
- 🚩 Flag Detection: Automatically find CTF flags with patterns like
flag{},CTF{},HTB{} - 🔐 Credential Extraction: Detect Basic Auth, form-based logins, passwords
- 🎫 Token Recognition: JWT tokens, API keys, Bearer tokens, AWS keys
- 🎨 Colorized Output: Beautiful terminal output using Rich
- 📊 Statistics: Detailed analysis statistics
- 💾 Export Results: Save findings to JSON format
- 🔧 Custom Regex: Use your own regex patterns for specific searches
- Flags:
flag{},CTF{},HTB{},DUCTF{},PICOCTF{} - Credentials: usernames, passwords, Basic Auth
- Tokens: JWT, API keys, Bearer tokens, Slack tokens, AWS keys
- Emails: Standard email format detection
- Hashes: MD5, SHA1, SHA256
- URLs: HTTP/HTTPS links
- Python 3.7+
- pip package manager
pip install -r requirements.txtRequired packages:
scapy- Packet parsing and analysisrich- Beautiful terminal output
1. Find all flags in a PCAP file:
python flagsniff.py -f capture.pcap --find flag2. Search for credentials:
python flagsniff.py -f capture.pcap --find credentials3. Find everything (flags, credentials, tokens):
python flagsniff.py -f capture.pcap --find all4. Use custom regex pattern:
python flagsniff.py -f capture.pcap --find all --regex "flag\\{.*?\\}"5. Export results to JSON:
python flagsniff.py -f capture.pcap --find all --export results.json6. Verbose output:
python flagsniff.py -f capture.pcap --find all --verboseusage: flagsniff.py [-h] -f FILE [--find {flag,credentials,tokens,all}]
[--regex REGEX] [--export EXPORT] [--verbose]
🎯 FlagSniff - CLI Tool for Packet Analysis & Flag Extraction
optional arguments:
-h, --help show this help message and exit
-f FILE, --file FILE Path to .pcap file
--find {flag,credentials,tokens,all}
What to search for (default: all)
--regex REGEX Custom regex pattern to search
--export EXPORT Export results to file (JSON format)
--verbose, -v Verbose output
📁 Loading PCAP file: sample.pcap
✅ Loaded 1500 packets
🎯 FlagSniff Results
┏━━━━━━━━━━━━┳━━━━━━━━━━┳━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Type ┃ Protocol ┃ Source ┃ Destination ┃ Found Data ┃
┡━━━━━━━━━━━━╇━━━━━━━━━━╇━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ FLAG │ HTTP │ 192.168.1.10 │ 192.168.1.1 │ flag{h3ll0_w0rld_fr0m_p4ck3t5} │
│ CREDENTIAL │ HTTP │ 192.168.1.20 │ 192.168.1.1 │ username=admin&password=secret123 │
│ TOKEN │ HTTP │ 192.168.1.30 │ 192.168.1.1 │ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... │
└────────────┴──────────┴───────────────┴───────────────┴───────────────────────────────────────────────────┘
┌─ Statistics ─┐
│ 📊 Analysis Statistics │
│ │
│ Total Packets: 1500 │
│ Analyzed Packets: 847 │
│ 🚩 Flags Found: 3 │
│ 🔐 Credentials Found: 7│
│ 🎫 Tokens Found: 2 │
└────────────────────────┘
flagsniff/
├── flagsniff.py # Main CLI tool
├── utils/
│ ├── __init__.py # Package initialization
│ ├── parsers.py # Packet parsing utilities
│ └── patterns.py # Pattern matching & regex
├── test_data/
│ └── sample.pcap # Sample PCAP for testing
├── requirements.txt # Python dependencies
└── README.md # This file
- Scapy: Handles PCAP file loading and packet parsing
- Rich: Provides colorized terminal output and tables
- Modular Design: Separate utilities for parsing and pattern matching
- HTTP: Web traffic, form data, headers
- DNS: Query/response analysis
- FTP: File transfer protocol
- Telnet: Remote terminal sessions
- TCP/UDP: General packet analysis
The tool uses carefully crafted regex patterns to identify:
- CTF Flags: Various flag formats from different competitions
- Authentication: Basic Auth, form-based, API keys
- Tokens: JWT, Bearer, API keys, cloud service tokens
- Sensitive Data: Emails, hashes, URLs
You can create custom regex patterns for specific needs:
# Search for Bitcoin addresses
python flagsniff.py -f capture.pcap --regex "[13][a-km-zA-HJ-NP-Z1-9]{25,34}"
# Find specific flag formats
python flagsniff.py -f capture.pcap --regex "MYCTF\\{[a-zA-Z0-9_]+\\}"from flagsniff import FlagSniff
# Initialize
fs = FlagSniff()
# Load packets
packets = fs.load_pcap("capture.pcap")
# Analyze
fs.analyze_packets(packets, ['flag', 'credentials'])
# Get results
results = fs.found_items- 🌐 Web Dashboard: Visual traffic flow and analysis
- 📈 Advanced Statistics: Detailed protocol breakdowns
- 🔄 Real-time Analysis: Live packet capture analysis
- 📊 CSV Export: Multiple export formats
- 🎮 Gaming Mode: CTF scoring system
- 🔍 Deep Inspection: SSL/TLS analysis, encrypted content
- 📱 Mobile App: Companion mobile application
- Fork the repository
- Create a feature branch:
git checkout -b feature-name - Commit changes:
git commit -am 'Add feature' - Push to branch:
git push origin feature-name - Submit a Pull Request
This project is licensed under the MIT License - see the LICENSE file for details.
FlagSniff is designed for educational purposes, authorized penetration testing, and CTF competitions. Always ensure you have proper authorization before analyzing network traffic. The authors are not responsible for any misuse of this tool.
Created for the red teaming and CTF community. Special thanks to:
- Scapy developers for the powerful packet analysis library
- Rich library for beautiful terminal interfaces
- The CTF community for inspiration and feedback
Happy Flag Hunting! 🚩