Packalyzer asks to register.

After registering and successful login, traffic can be sniffed and respective .pcap downloaded.
It contains TLSv1.2 traffic. Master secret log file is required to decrypt this traffic.

Going back and looking at HTML source, there is a interesting comment.

//File upload Function. All extensions and sizes are validated server-side in app.js

Manually trying to find real app.js location, e.g., /app.js, /pub/js/app.js, etc., finally, leads to https://packalyzer.kringlecastle.com/pub/app.js. It contains enabled debugging mode (line 26), which can be abused (lines 88, 78-83 and 164) by disclosing environment variable SSLKEYLOGFILE (seen in line 27).

const dev_mode = true;
const key_log_path = ( !dev_mode || __dirname + process.env.DEV + process.env.SSLKEYLOGFILE )

function load_envs() {
  var dirs = []
  var env_keys = Object.keys(process.env)
  for (var i=0; i < env_keys.length; i++) {
    if (typeof process.env[env_keys[i]] === "string" ) {
      dirs.push(( "/"+env_keys[i].toLowerCase()+'/*') )
    }
  }
  return uniqueArray(dirs)
}
if (dev_mode) {
    //Can set env variable to open up directories during dev
    const env_dirs = load_envs();
} else {
    const env_dirs = ['/pub/','/uploads/'];
}

//Route for anything in the public folder except index, home and register
router.get(env_dirs,  async (ctx, next) => {
try {
    var Session = await sessionizer(ctx);
    //Splits into an array delimited by /
    let split_path = ctx.path.split('/').clean("");
    //Grabs directory which should be first element in array
    let dir = split_path[0].toUpperCase();
    split_path.shift();
    let filename = "/"+split_path.join('/');
    while (filename.indexOf('..') > -1) {
    filename = filename.replace(/\.\./g,'');
    }
    if (!['index.html','home.html','register.html'].includes(filename)) {
    ctx.set('Content-Type',mime.lookup(__dirname+(process.env[dir] || '/pub/')+filename))
    ctx.body = fs.readFileSync(__dirname+(process.env[dir] || '/pub/')+filename)
    } else {
    ctx.status=404;
    ctx.body='Not Found';
    }
} catch (e) {
    ctx.body=e.toString();
}
});

Browsing to https://packalyzer.kringlecastle.com/SSLKEYLOGFILE/ returns an error, which discloses SSLKEYLOGFILE value as packalyzer_clientrandom_ssl.log.

Error: ENOENT: no such file or directory, open '/opt/http2packalyzer_clientrandom_ssl.log/'

Recalling app.js code, key_log_path corresponds to https://packalyzer.kringlecastle.com/DEV/packalyzer_clientrandom_ssl.log.

const key_log_path = ( !dev_mode || __dirname + process.env.DEV + process.env.SSLKEYLOGFILE )

Now traffic in .pcap can be decrypted. To do it with WireShark, open Edit -> Preferences, select Protocols -> SSL and in (Pre)-Master-Secret log filename browse for downloaded packalyzer_clientrandom_ssl.log file.

After decryption, http2 traffic can be analyzed either manually or by using WireShark's filter, i.e., http2.data.data.
There is a packet, which contains JSON data with credentials.

{"username": "alabaster", "password": "Packer-p@re-turntable192"}

Re-login to Packalyzer with alabaster user and within Captures there is super_secret_packet_capture.pcap. It contains plain-text SMTP session where an email with attachment is being sent from Holly Evergreen to Alabaster Snowball.

220 mail.kringlecastle.com ESMTP Postfix (Ubuntu)
EHLO Mail.kringlecastle.com
250-mail.kringlecastle.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN

MAIL FROM:<Holly.evergreen@mail.kringlecastle.com>
250 2.1.0 Ok
RCPT TO:<alabaster.snowball@mail.kringlecastle.com>
250 2.1.5 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
Date: Fri, 28 Sep 2018 11:33:17 -0400
To: alabaster.snowball@mail.kringlecastle.com
From: Holly.evergreen@mail.kringlecastle.com
Subject: test Fri, 28 Sep 2018 11:33:17 -0400
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----=_MIME_BOUNDARY_000_11181"

------=_MIME_BOUNDARY_000_11181
Content-Type: text/plain

Hey alabaster, 

Santa said you needed help understanding musical notes for accessing the vault. He said your favorite key was D. Anyways, the following attachment should give you all the information you need about transposing music.

------=_MIME_BOUNDARY_000_11181
Content-Type: application/octet-stream
Content-Transfer-Encoding: BASE64
Content-Disposition: attachment

JVBERi0xLjUKJb/3ov4KOCAwIG9iago8PCAvTGluZWFyaXplZCAxIC9MIDk3ODMxIC9IIFsgNzM4
(..)

Attachment is a .pdf file, mail.pdf, which contains information about music sheet transposing, but the most relevant information is name of song.

Answer to this objective is Mary Had a Little Lamb.