Ctf Osint

CTF 开源情报 (OSINT)

深入参考

以下参考资料按需加载，根据识别出的具体方向选择对应文件：

• 社交媒体调查（Twitter/Tumblr/BlueSky/Discord/用户名枚举） → references/social-media.md
• 地理定位与媒体分析（反向图搜/街景匹配/MGRS/EXIF） → references/geolocation-and-media.md
• Web 与 DNS 侦察（Dorking/Wayback/Zone Transfer/WHOIS） → references/web-and-dns.md

---

分类决策树

OSINT 题目？
├─ 找人/找账号
│  ├─ 用户名 → whatsmyname.app / namechk.com (741+ 站点)
│  ├─ Twitter/X → 数字 User ID 持久追踪 / Snowflake 时间戳
│  ├─ Tumblr → curl -sI 检查 x-tumblr-user / avatar/512
│  └─ BlueSky → public.api.bsky.app (无需认证)
├─ 找位置（地理定位）
│  ├─ 图片 → Google Lens 裁剪搜索 / Yandex(人脸) / TinEye
│  ├─ 路标/铁路 → OpenRailwayMap / OpenInfraMap
│  ├─ MGRS 坐标 → 在线转换器 → Google Maps
│  ├─ Plus Codes → `XXXX+XXX` 格式 → Google Maps
│  └─ 街景匹配 → 特征提取 + 多指标相似度排序
├─ 找信息
│  ├─ DNS → dig TXT/CNAME/MX / zone transfer
│  ├─ Google Dorking → site: filetype: intitle:
│  ├─ Wayback Machine → 历史快照
│  ├─ WHOIS → 反向WHOIS / 历史WHOIS / IP/ASN
│  └─ GitHub → issue/PR/commit/wiki 分析
└─ 特殊场景
   ├─ Tor 中继 → metrics.torproject.org 指纹查询
   ├─ FEC 政治捐款 → FEC.gov
   └─ Unicode 同形字隐写 → ASCII=0, 同形字=1

快速命令

# 元数据提取
exiftool image.jpg
pdfinfo document.pdf

# DNS 侦察
dig -t txt domain.com
dig axfr @ns.domain.com domain.com

# IP 地理定位
curl "http://ip-api.com/json/IP_ADDR"

# Google Dorking
# site:example.com filetype:pdf
# intitle:"index of" password

# Flag 搜索
grep -rniE '(flag|ctf)\{' .

字符串识别

常用工具

Google Dorking

• 检查 robots.txt、sitemap、.git 等信息泄露源

Geolocation and Media Analysis

Table of Contents

• Image Analysis
• Reverse Image Search
• Geolocation Techniques
• MGRS (Military Grid Reference System)
• Google Plus Codes / Open Location Codes (MidnightCTF 2026)
• Metadata Extraction
• Hardware/Product Identification
• Newspaper Archives and Historical Research
• Google Street View Panorama Matching (EHAX 2026)
• Road Sign Language and Driving Side Analysis (EHAX 2026)
• Post-Soviet Architecture and Brand Identification (EHAX 2026)
• IP Geolocation and Attribution
• Google Lens Cropped Region Search (UTCTF 2026)
• Reflected and Mirrored Text Reading (UTCTF 2026)
• What3Words (W3W) Geolocation (UTCTF 2026)
• Monumental Letters / Letreiro Identification (UTCTF 2026)
• Google Maps Crowd-Sourced Photo Verification (MidnightCTF 2026)
• Overpass Turbo Spatial Queries (LAB'OSINT 2025)

---

Image Analysis

• Discord avatars: Screenshot and reverse image search
• Identify objects in images (weapons, equipment) -> find character/faction
• No EXIF? Use visual features (buildings, signs, landmarks)
• Visual steganography: Flags hidden as tiny/low-contrast text in images (not binary stego)
• Always view images at full resolution and check ALL corners/edges
• Black-on-dark or white-on-light text, progressively smaller fonts
• Profile pictures/avatars are common hiding spots
• Twitter strips EXIF on upload - don't waste time on stego for Twitter-served images
• Tumblr preserves more metadata in avatars than in post images

Reverse Image Search

• Google Lens (crop to specific region, best for identifying landmarks/shops/signs)
• Google Images (most comprehensive)
• TinEye (exact match)
• Yandex (good for faces, Eastern Europe)
• Baidu Images / graph.baidu.com (best for Chinese locations — use when visual cues suggest China: blue license plates, simplified Chinese text, menlou gate architecture)
• Bing Visual Search

Geolocation Techniques

• Railroad crossing signs: white X with red border = Canada
• Use infrastructure maps:
• Open Infrastructure Map - power lines
• OpenRailwayMap - rail tracks
• High-voltage transmission line maps
• Process of elimination: narrow by country first, then region
• Cross-reference multiple features (rail + power lines + mountains)
• MGRS coordinates: grid-based military system (e.g., "4V FH 246 677") -> convert online

MGRS (Military Grid Reference System)

Pattern (On The Grid): Encoded coordinates like "4V FH 246 677".

Identification: Challenge title mentions "grid", code format matches MGRS pattern.

Conversion: Use online MGRS converter -> lat/long -> Google Maps for location name.

Google Plus Codes / Open Location Codes (MidnightCTF 2026)

Pattern (Chine Zhao): Flag format requires a Google Plus Code (e.g., H9G2+47X) instead of coordinates or W3W. Plus Codes are Google's open-source alternative to street addresses.

Format: XXXX+XX (short/local) or 8FVC9G8F+6W (full/global). Characters from the set 23456789CFGHJMPQRVWX. The + separator is always present.

Generating a Plus Code: 1. Find the exact location on Google Maps 2. Click the map to drop a pin at the precise spot 3. The Plus Code appears in the location details panel (e.g., H9G2+47X Handan, Hebei, China) 4. Or enter coordinates in the Google Maps search bar — the Plus Code shows in results

Precision: Standard Plus Codes resolve to ~14m x 14m areas (vs. W3W's 3m x 3m). Adding extra characters increases precision. Meter-level position changes can alter the code.

Key insight: Unlike W3W (proprietary, requires API key), Plus Codes are free and built into Google Maps. When a flag format shows {XXXX+XXX}, recognize it as a Plus Code. Position the Street View camera at the exact photo capture location, then read the Plus Code from the map pin.

Reference: https://maps.google.com/pluscodes/

---

Metadata Extraction

exiftool image.jpg           # EXIF data
pdfinfo document.pdf         # PDF metadata
mediainfo video.mp4          # Video metadata

Hardware/Product Identification

Pattern (Computneter, VuwCTF 2025): Battery specifications -> manufacturer identification. Cross-reference specs (voltage, capacity, form factor) with manufacturer databases.

Newspaper Archives and Historical Research

• Scout Life magazine archive: https://scoutlife.org/wayback/
• Library of Congress: https://www.loc.gov/ (newspaper search)
• Use advanced search with date ranges

Pattern (It's News, VuwCTF 2025): Combine newspaper archive date search with EXIF GPS coordinates for location-specific identification.

Tools: Library of Congress newspaper archive, Google Maps for GPS coordinate lookup.

Google Street View Panorama Matching (EHAX 2026)

Pattern (amnothappyanymore): Challenge image is a cropped section of a Google Street View panorama. Must identify the exact panorama ID and coordinates.

Approach: 1. Extract visual features: Identify distinctive landmarks (road type, vehicles, containers, mountain shapes, building styles, vegetation) 2. Narrow the region: Use visual clues to identify country/region (e.g., Greenland landscape, specific road infrastructure) 3. Compile candidate panoramas: Use Google Street View coverage maps to find panoramas in the identified region 4. Feature matching: Compare challenge image features against candidate panoramas:

   import cv2
   import numpy as np

   # Load challenge image and candidate panorama
   challenge = cv2.imread('challenge.jpg')
   candidate = cv2.imread('panorama.jpg')

   # ORB feature detection and matching
   orb = cv2.ORB_create(nfeatures=5000)
   kp1, des1 = orb.detectAndCompute(challenge, None)
   kp2, des2 = orb.detectAndCompute(candidate, None)

   bf = cv2.BFMatcher(cv2.NORM_HAMMING, crossCheck=True)
   matches = bf.match(des1, des2)
   score = sum(1 for m in matches if m.distance < 50)

5. Ranking systems: Use multiple scoring methods (global feature match, local patch comparison, color histogram analysis) and combine rankings 6. API submission: Submit panorama ID with coordinates in required format (e.g., lat/lng/sessionId/nonce)

Google Street View API patterns:

# Street View metadata API (check if coverage exists)
# GET https://maps.googleapis.com/maps/api/streetview/metadata?location=LAT,LNG&key=KEY

# Street View image API
# GET https://maps.googleapis.com/maps/api/streetview?size=640x480&location=LAT,LNG&heading=90&key=KEY

# Panorama ID from page source (parsed from JavaScript):
# Look for panoId in page data structures

Key insights:

• Challenge images are often crops of panoramas — the crop region may not include horizon or sky, making geolocation harder
• Distinctive elements: road surface type, vehicle makes, signage language, utility poles, container colors
• Greenland, Iceland, Faroe Islands have limited Street View coverage — enumerate all panoramas in the region
• Image similarity ranking with multiple metrics (feature matching + color analysis + patch comparison) is more robust than any single method

---

Road Sign Language and Driving Side Analysis (EHAX 2026)

Pattern (date_spot): Street view image of a coastal location. Identify exact coordinates from road infrastructure.

Systematic approach: 1. Driving side: Left-hand traffic → right-hand drive countries (Japan, UK, Australia, etc.) 2. Sign language/script: Kanji → Japan; Cyrillic → Russia/CIS; Arabic → Middle East/North Africa 3. Road sign style: Blue directional signs with white text and route numbers → Japanese expressways 4. Sign OCR: Extract text from directional signs to identify town/city names and route designations 5. Route tracing: Search identified route number + town names to find the road corridor 6. Terrain matching: Match coastline, harbors, lighthouses, bridges against satellite view

Japanese infrastructure clues:

• Blue highway signs with white Kanji + route numbers (e.g., E59)
• Distinctive guardrail style (galvanized steel, wavy profile)
• Concrete seawalls on coastal roads
• Small fishing harbors with white lighthouse structures

General country identification shortcuts:

---

Post-Soviet Architecture and Brand Identification (EHAX 2026)

Pattern (idinahui): Coastal parking lot image. Identify location from architectural style, vehicle types, signage, and local brands.

Recognition chain: 1. Architecture: Brutalist concrete buildings → post-Soviet region 2. Vehicles: Reverse image search vehicle models to narrow to Russian/CIS market cars 3. Script: Cyrillic signage confirms Russian-language region 4. Flags: Regional government flags alongside national tricolor → identify specific federal subject 5. Brands: Named restaurants/chains (e.g., "Mimino" — Georgian-themed chain popular across Russia) → search for geographic distribution 6. Coastal features: Caspian Sea coastline + North Caucasus architecture → Dagestan/Makhachkala

Key technique — restaurant/brand geolocation:

• Identify any readable business name or brand logo
• Search for that business + "locations" or "branches"
• Cross-reference with other visual clues (coastline, terrain) to pinpoint exact branch
• Google Maps business search is highly effective for named establishments

Post-Soviet visual markers:

• Panel apartment blocks (khrushchyovka/brezhnevka)
• Wide boulevards with central medians
• Concrete bus stops
• Distinctive utility pole designs
• Soviet-era monuments and mosaics

---

IP Geolocation and Attribution

Free geolocation services:

# IP-API (no key required)
curl "http://ip-api.com/json/103.150.68.150"

# ipinfo.io
curl "https://ipinfo.io/103.150.68.150/json"

Bangladesh IP ranges (common in KCTF):

• 103.150.x.x - Bangladesh ISPs
• Mobile prefixes: +880 13/14/15/16/17/18/19

Correlating location with evidence:

• Windows telemetry (imprbeacons.dat) contains CIP field
• Login history APIs may show IP + OS correlation
• VPN/proxy detection via ASN lookup

---

Google Lens Cropped Region Search (UTCTF 2026)

Pattern (W3W1/W3W2): Challenge image contains multiple elements but only one is useful for identification. Crop to just the relevant portion before searching.

Technique: 1. Identify the most distinctive element in the image (shop sign, building facade, landmark) 2. Crop the image to isolate that element — remove surrounding context that adds noise 3. Search the cropped region using Google Lens (lens.google.com or right-click → "Search image with Google Lens" in Chrome) 4. Review visually similar results to identify the specific location or business

When to crop:

• Shop fronts: crop to just the storefront and signage
• Landmarks: crop to the distinctive architectural feature
• Signs: crop to just the sign text
• Churches/buildings: crop to the unique facade

Key insight: Google Lens performs significantly better on cropped regions than full scene images. A full scene may return generic landscape results, while a cropped shop sign returns the exact business with its address.

Example workflow (W3W2): 1. Challenge image shows a street scene with a shop 2. Crop to just the shop portion 3. Google Lens identifies the shop and its location 4. Verify on Google Maps Street View 5. Convert coordinates to What3Words

---

Reflected and Mirrored Text Reading (UTCTF 2026)

Pattern (W3W3): Text visible in the image is reflected/mirrored (e.g., sign reflected in water or glass). Must read the text in reverse to identify the location.

Technique: 1. Identify reflected text in the image (common in water reflections, glass surfaces, mirrors) 2. Flip the image horizontally to read the text normally 3. If text is partially obscured, search for the readable portion as a prefix/suffix:

• "Aguas de Lind..." → search "Aguas de Lind" → find "Aguas de Lindoia"

4. Use the identified text to locate the place on Google Maps

Partial text search strategies:

# Search with wildcards/partial terms
"Aguas de Lind"           # Quoted partial match
"Aguas de Lind" city      # Add context keyword
"Aguas de Lind*" brazil   # Add country if identifiable from image

Image flipping for reflected text:

# Flip image horizontally with ImageMagick
convert input.jpg -flop flipped.jpg

# Or with Python/PIL
python3 -c "
from PIL import Image
img = Image.open('input.jpg')
img.transpose(Image.FLIP_LEFT_RIGHT).save('flipped.jpg')
"

Key insight: When a letter in reflected text is ambiguous (e.g., "T" vs "I"), try both variants as separate searches. Partial text searches with quoted strings are effective for identifying place names even with only 60-70% of the text readable.

---

What3Words (W3W) Geolocation (UTCTF 2026)

Pattern (W3W1/W3W2/W3W3): Photo of a location. Find the exact What3Words address (3-meter precision grid). Flag format: utflag{word1.word2.word3}.

What3Words basics:

• Divides entire world into 3m x 3m squares, each with a unique 3-word address
• Words are in a SPECIFIC language (English by default)
• Adjacent squares have COMPLETELY different addresses (no spatial correlation)
• Website: https://what3words.com/

Workflow: 1. Identify the location using standard geolocation techniques (reverse image search, landmarks, signs, architecture) 2. Get precise GPS coordinates from Google Maps satellite view 3. Convert coordinates to W3W using the website (enter coordinates in search bar) 4. Fine-tune: The exact 3m square matters — shift coordinates by small amounts to check adjacent squares

Coordinate-to-W3W conversion:

# Navigate to what3words.com and enter coordinates:
# Format: latitude, longitude (e.g., 30.2870, -97.7415)
# Or click on the map at the exact location

# The W3W API requires an API key (not always available in CTF):
# GET https://api.what3words.com/v3/convert-to-3wa?coordinates=30.2870,-97.7415&key=API_KEY

Common pitfalls:

• 3m precision matters: A building entrance vs. its parking lot may have different W3W addresses. Match the EXACT viewpoint of the photo.
• Camera position vs. subject: The W3W address may refer to where the camera IS, not what it's pointed at.
• Satellite vs. street-level: Google Maps pin may not perfectly align with the actual W3W grid.
• Multiple buildings nearby: Churches, shops, and landmarks may have several candidate squares.

Tips for accurate pinpointing:

• Use Google Street View to match the exact camera angle
• Cross-reference with OpenStreetMap (OSM) for precise building footprints
• Try 5-10 adjacent W3W addresses around your best guess
• The challenge image often shows a specific feature (entrance, sign, landmark) — find THAT exact spot
• Micro-landmark matching: Identify small distinctive features in the challenge image (utility poles, pathway rocks, bollards, planters) and locate the same features in Street View to pinpoint the exact 3m square
• Background building triangulation: Match buildings visible in the background from the challenge image angle. Find those same buildings in Street View, then determine where the camera must be positioned to produce the same perspective
• Geographic feature narrowing: When you know the city but not the exact spot, use distinctive geographic features (lakes, rivers, coastline) visible in the image to narrow the search area before switching to Street View

---

Monumental Letters / Letreiro Identification (UTCTF 2026)

Pattern (W3W3): Photo of large 3D letters spelling a city/location name, often reflected in a pool of water. Common in Latin American cities as tourist landmarks.

Identification clues:

• Large colorful 3D block letters
• Often located in main plaza (praça) or tourist area
• May include city name in local language
• Reflection in decorative water pool is a common design

Search strategy:

• Google: "letras monumentales" [city name] or "letreiro turístico" [city]
• OpenStreetMap: search for nodes tagged as tourism=attraction near the city center
• Google Maps: search [city name] sign or [city name] letters and check photos

Key insight: These monumental letter installations ("letras monumentales" in Spanish, "letreiro turístico" in Portuguese) are extremely common in Latin American cities. The exact GPS coordinates of the installation can be found on OpenStreetMap or Google Maps photo pins.

---

Google Maps Crowd-Sourced Photo Verification (MidnightCTF 2026)

Pattern (Where was Chine): Verify a candidate location by matching a challenge image against user-submitted Google Maps photos for that place.

Workflow: 1. Identify a candidate location name from other OSINT clues (Strava GPS routes, address research, social media posts) 2. Search the location name on Google Maps 3. Click the location pin and browse the Photos tab (user-submitted images) 4. Compare scene elements (buildings, trees, paths, water features, signage) against the challenge image 5. Match confirms the location — the place name is typically the flag

When to use: After narrowing to a candidate location through non-visual OSINT (fitness routes, addresses, social connections), use Google Maps photos as final visual confirmation. Especially useful for parks, plazas, and landmarks where many tourists upload photos.

Key insight: Google Maps aggregates crowd-sourced photos tagged to specific locations. Even when reverse image search fails (because the challenge image is original, not scraped), the same physical scene appears in tourist photos. Search by place name, not by image.

---

Overpass Turbo Spatial Queries (LAB'OSINT 2025)

Pattern (Portrait robot): Find a specific business (newsagent) near a metro entrance in a known city. Overpass Turbo queries OpenStreetMap data to locate POIs by type within a radius of other POIs.

Tool: https://overpass-turbo.eu/

Example — find newsagents within 10m of metro entrances in Barcelona:

[out:json][timeout:25];
{{geocodeArea:Barcelona}}->.searchArea;

(
  node["railway"="subway_entrance"](area.searchArea);
)->.metros;

(
  node(around.metros:10)["shop"~"newsagent|kiosk"];
  way(around.metros:10)["shop"~"newsagent|kiosk"];
);

out body;
>;
out skel qt;

Common query patterns for OSINT:

# All cafes near train stations in a city
{{geocodeArea:CityName}}->.a;
node["railway"="station"](area.a)->.stations;
node(around.stations:50)["amenity"="cafe"];

# All ATMs in a neighborhood
node["amenity"="atm"]({{bbox}});

# Hotels near a specific coordinate (lat,lon)
node(around:200,48.8566,2.3522)["tourism"="hotel"];

Key OSM tags for OSINT challenges:

Key insight: When a challenge image shows a business near a transit stop in a known city, Overpass Turbo can narrow candidates to a handful of locations by querying for the business type within a small radius of transit nodes. Verify each result with Google Street View. The around operator (proximity filter) is the most useful feature — it replaces hours of manual map browsing.

Social Media OSINT

Table of Contents

• Twitter/X Account Tracking
• Tumblr Investigation
• BlueSky Advanced Search
• Username OSINT
• Platform False Positives
• Social Media General Tips
• Multi-Platform OSINT Chain
• MetaCTF OSINT Challenge Patterns
• Unicode Homoglyph Steganography on BlueSky (MetaCTF 2026)
• Strava Fitness Route OSINT (MidnightCTF 2026)
• Discord API Enumeration

---

Twitter/X Account Tracking

Persistent numeric User ID (key technique):

• Every Twitter/X account has a permanent numeric ID that never changes
• Access any account by ID: https://x.com/i/user/<numeric_id> -- works even after username changes
• Find user ID from archived pages (JSON-LD "author":{"identifier":"..."})
• Useful when username is deleted/changed but you have the ID from forensic artifacts

Username rename detection:

• Twitter User IDs persist across username changes; t.co shortlinks point to OLD usernames
• Wayback CDX API to find archived profiles: http://web.archive.org/cdx/search/cdx?url=twitter.com/USERNAME*&output=json
• Archived pages contain JSON-LD with user ID, creation date, follower/following counts
• t.co links in archived tweets reveal previous usernames (the redirect URL contains the username at time of posting)
• Same tweet ID accessible under different usernames = confirmed rename

Alternative Twitter data sources:

• Nitter instances (e.g., nitter.poast.org/USERNAME) show tweets without login
• Syndication API: https://syndication.twitter.com/srv/timeline-profile/screen-name/USERNAME
• Twitter Snowflake IDs encode timestamps: (id >> 22) + 1288834974657 = Unix ms
• memory.lol and twitter.lolarchiver.com track username history

Wayback Machine for Twitter:

# Find all archived URLs for a username
curl "http://web.archive.org/cdx/search/cdx?url=twitter.com/USERNAME*&output=json&fl=timestamp,original,statuscode"

# Also check profile images
curl "http://web.archive.org/cdx/search/cdx?url=pbs.twimg.com/profile_images/*&output=json"

# Check t.co shortlinks
curl "http://web.archive.org/cdx/search/cdx?url=t.co/SHORTCODE&output=json"

Tumblr Investigation

Blog existence check:

• curl -sI "https://USERNAME.tumblr.com" -> look for x-tumblr-user header (confirms blog exists even if API returns 401)
• Tumblr API may return 401 (Unauthorized) but the blog is still publicly viewable via browser

Extracting post content from Tumblr HTML:

• Tumblr embeds post data as JSON in the page HTML
• Search for "content":[ to find post body data
• Posts contain type: "text" with text field, and type: "image" with media URLs
• Avatar URL pattern: https://64.media.tumblr.com/HASH/HASH-XX/s512x512u_c1/FILENAME.jpg

Avatar as flag container:

• Direct avatar endpoint: https://api.tumblr.com/v2/blog/USERNAME.tumblr.com/avatar/512
• Or simply: https://USERNAME.tumblr.com/avatar/512 (redirects to CDN URL)
• Available sizes: 16, 24, 30, 40, 48, 64, 96, 128, 512
• Flags may be hidden as small text in avatar images (visual stego, not binary stego)
• Always download highest resolution (512) and zoom in on all areas

BlueSky Advanced Search

Pattern (Ms Blue Sky): Find target's posts on BlueSky social media.

Search filters:

from:username        # Posts from specific user
since:2025-01-01     # Date range
has:images           # Posts with images

Reference: https://bsky.social/about/blog/05-31-2024-search

Username OSINT

• namechk.com - Check username across platforms
• whatsmyname.app - Username enumeration (741+ sites)
• Osint Industries - Cross-platform people search (paid, covers fitness/niche platforms)
• Search "username" in quotes on major platforms

Username metadata mining: Usernames often embed geographic or temporal signals in their structure. Extract and research numeric suffixes, prefixes, or embedded patterns:

Cross-reference extracted codes with postal code databases, phone number registries, or geographic gazetteers to narrow the subject's location. (MidnightCTF 2026)

Username chain tracing (account renames): 1. Start with known username -> find Wayback archives 2. Look for t.co links or cross-references to other usernames in archived pages 3. Discovered new username -> enumerate across ALL platforms again 4. Repeat until you find the platform with the flag

Priority platforms for CTF username enumeration:

• Twitter/X, Tumblr, GitHub, Reddit, Bluesky, Mastodon
• Spotify, SoundCloud, Steam, Keybase
• Strava, Garmin Connect, MapMyRun (fitness/GPS — leak physical locations)
• Pastebin, LinkedIn, YouTube, TikTok
• bio-link services (linktr.ee, bio.link, about.me)

Platform False Positives

Platforms that return 200 but no real profile:

• Telegram (t.me/USER): Always returns 200 with "Contact @USER" page; check for "View" vs "Contact" in title
• TikTok: Returns 200 with "Couldn't find this account" in body
• Smule: Returns 200 with "Not Found" in page content
• linkin.bio: Redirects to Later.com product page for unclaimed names
• Instagram: Returns 200 but shows login wall (may or may not exist)

Social Media General Tips

• Check Wayback Machine for deleted posts on Bluesky, Twitter, etc.
• Unlisted YouTube videos may be linked in deleted posts
• Bio links lead to itch.io, personal sites with more info
• Search "username" with quotes on platform-specific searches
• Challenge titles are often hints (e.g., "Linked Traces" -> LinkedIn / linked accounts)
• Twitter strips EXIF on upload - don't waste time on stego for Twitter-served images
• Tumblr preserves more metadata in avatars than in post images

Multi-Platform OSINT Chain

Pattern (Massive-Equipment393): Reddit username -> Spotify social link -> Base58-encoded string -> Spotify playlist descriptions (base64) -> first-letter acrostic from song titles.

Key techniques:

• Base58 decoding for non-standard encodings
• Spotify playlists encode data in descriptions and song title initials
• Platform chaining: each platform links to the next

MetaCTF OSINT Challenge Patterns

Common flow: 1. Start image with hidden EXIF/metadata -> extract username 2. Username enumeration (Sherlock/WhatsMyName) across platforms 3. Find profile on platform X with clues pointing to platform Y 4. Flag hidden on the final platform (Spotify bio, BlueSky post, Tumblr avatar, etc.)

Platform-specific flag locations:

• Spotify: playlist names, artist bio
• BlueSky: post content
• Tumblr: avatar image, post text
• Reddit: post/comment content
• Smule: song recordings or bio
• SoundCloud: track description

Key techniques:

• Account rename tracking via Wayback + t.co links
• Cross-platform username correlation
• Visual inspection of all profile images at max resolution
• Song lyric identification -> artist/song as flag component

Unicode Homoglyph Steganography on BlueSky (MetaCTF 2026)

Pattern (Skybound Secrets): Flag hidden in a Bluesky post using Unicode homoglyph steganography — visually identical characters from different Unicode blocks encode binary data.

Detection:

• Post text looks normal but character-by-character analysis reveals non-ASCII codepoints
• Characters from Cyrillic (а U+0430 vs a U+0061), Greek, Armenian, Mathematical Monospace, etc.
• Each character encodes 1 bit: ASCII = 0, homoglyph = 1

Bluesky API search workflow:

# Search for posts about the CTF
curl -s "https://public.api.bsky.app/xrpc/app.bsky.feed.searchPosts?q=metactf+flash+ctf&sort=latest" | jq '.posts[].record.text'

# Search for specific accounts
curl -s "https://public.api.bsky.app/xrpc/app.bsky.actor.searchActors?q=metactf" | jq '.actors[].handle'

# Get profile
curl -s "https://public.api.bsky.app/xrpc/app.bsky.actor.getProfile?actor=metactf.bsky.social" | jq

# Get author feed (all posts)
curl -s "https://public.api.bsky.app/xrpc/app.bsky.feed.getAuthorFeed?actor=metactf.bsky.social&limit=50" | jq '.feed[].post.record.text'

# Get post thread (including replies)
curl -s "https://public.api.bsky.app/xrpc/app.bsky.feed.getPostThread?uri=at://did:plc:.../app.bsky.feed.post/..." | jq

Decoding homoglyph steganography:

def decode_homoglyph_stego(text):
    bits = []
    for ch in text:
        if ch in ('\u2019',):  # Platform auto-inserted right single quote
            continue  # Skip, not intentional homoglyph
        if ord(ch) < 128:
            bits.append(0)  # Standard ASCII
        else:
            bits.append(1)  # Unicode homoglyph = 1 bit

    # Group into bytes (MSB first)
    flag = ''
    for i in range(0, len(bits) - 7, 8):
        byte_val = 0
        for j in range(8):
            byte_val = (byte_val << 1) | bits[i + j]
        flag += chr(byte_val)
    return flag

Common homoglyph pairs:

Key lessons:

• Check ALL replies to official CTF posts, not just the main post
• Platform auto-formatting (smart quotes ' → ') must be excluded from bit encoding
• Hints like "hype comes with its own secrets" suggest steganography in the social media posts themselves
• Bluesky public API requires no authentication — use public.api.bsky.app

---

Strava Fitness Route OSINT (MidnightCTF 2026)

Pattern (Where was Chine): Target's physical location identified through fitness tracking data. Username discovered on Twitter → alias found in GitHub code → alias searched on Strava → running route endpoint reveals location.

Strava public data exposure:

• Public athlete profiles: https://www.strava.com/athletes/<id>
• Activity maps show GPS routes with start/end points
• Even "privacy zones" can be circumvented by analyzing route shapes outside the zone
• Segment leaderboards reveal athlete locations without following them

Location extraction workflow: 1. Find target's Strava profile via username enumeration (Whatsmyname, Osint Industries) 2. Check public activities for GPS route maps 3. Identify route start/end points or frequent locations 4. Search the endpoint location on Google Maps 5. Verify with Google Maps user-submitted photos (see geolocation-and-media.md)

Key insight: Fitness apps are high-value OSINT targets because users rarely restrict activity visibility. A single public run reveals home/work neighborhoods. Cross-reference GPS endpoints with Google Maps to identify specific parks, buildings, or landmarks.

Detection: Challenge mentions exercise, running, cycling, fitness, GPS, or health tracking. Target persona has an active/athletic profile.

---

Discord API Enumeration

Pattern (Insanity 1 & 2, 0xFun 2026): Flags hidden in Discord server metadata not visible in normal UI.

Hiding spots:

• Role names
• Animated GIF emoji (flag in 2nd frame with tiny duration)
• Message embeds
• Server description, stickers, events

# Enumerate with user token
TOKEN="your_token"
# List roles
curl -H "Authorization: $TOKEN" "https://discord.com/api/v10/guilds/GUILD_ID/roles"
# List emojis
curl -H "Authorization: $TOKEN" "https://discord.com/api/v10/guilds/GUILD_ID/emojis"
# Search messages
curl -H "Authorization: $TOKEN" "https://discord.com/api/v10/guilds/GUILD_ID/messages/search?content=flag"

Animated emoji: Download GIF, extract frames -- hidden data in brief frames invisible at normal speed.

Web and DNS OSINT

Table of Contents

• Google Dorking
• Google Docs/Sheets in OSINT
• DNS Reconnaissance
• DNS TXT Record OSINT
• Tor Relay Lookups
• GitHub Repository Comments
• Telegram Bot Investigation
• FEC Political Donation Research
• Wayback Machine
• WHOIS Investigation
• Resources

---

Google Dorking

site:example.com filetype:pdf
intitle:"index of" password
inurl:admin
"confidential" filetype:doc

Google Image TBS (To Be Searched) parameters:

Append &tbs= filters to Google Image search URLs for precision filtering:

Combined example: Search LinkedIn for face photos of interns at a company:

https://www.google.com/search?q="orange"+"alternant"+site:linkedin.com&tbm=isch&tbs=itp:face

Key insight: The itp:face filter is especially useful for OSINT — it strips out logos, banners, and UI screenshots from results, leaving only profile photos. Combine with site: and date range (after:YYYY-MM-DD) for targeted reconnaissance.

Google Docs/Sheets in OSINT

• Suspects may link to Google Sheets/Docs in tweets or posts
• Try public access URLs:
• /export?format=csv - Export as CSV
• /pub - Published version
• /gviz/tq?tqx=out:csv - Visualization API CSV export
• /htmlview - HTML view
• Private sheets require authentication; flag may be in the sheet itself
• Sheet IDs are stable identifiers even if sharing settings change

DNS Reconnaissance

Flags often in TXT records of subdomains, not root domain:

dig -t txt subdomain.ctf.domain.com
dig -t any domain.com
dig axfr @ns.domain.com domain.com  # Zone transfer

DNS TXT Record OSINT

dig TXT ctf.domain.org
dig TXT _dmarc.domain.org
dig ANY domain.org

Lesson: DNS TXT records are publicly queryable. Always check TXT, CNAME, MX for CTF domains and subdomains.

Tor Relay Lookups

https://metrics.torproject.org/rs.html#simple/<FINGERPRINT>

Check family members and sort by "first seen" date for ordered flags.

GitHub Repository Comments

Pattern (Rogue, VuwCTF 2025): Hidden information in GitHub repo comments (issue comments, PR reviews, commit messages, wiki edits).

Check: gh api repos/OWNER/REPO/issues/comments, gh api repos/OWNER/REPO/commits, wiki edit history.

Telegram Bot Investigation

Pattern: Forensic artifacts (browser history, chat logs) may reference Telegram bots that require active interaction.

Finding bot references in forensics:

# Search browser history for Telegram URLs
import sqlite3
conn = sqlite3.connect("History")  # Edge/Chrome history DB
cur = conn.cursor()
cur.execute("SELECT url FROM urls WHERE url LIKE '%t.me/%'")
# Example: https://t.me/comrade404_bot

Bot interaction workflow: 1. Visit https://t.me/<botname> -> Opens in Telegram 2. Start conversation with /start or bot's custom command 3. Bot may require verification (CTF-style challenges) 4. Answers often require knowledge from forensic analysis

Verification question patterns:

• "Which user account did you use for X?" -> Check browser history, login records
• "Which account was modified?" -> Check Security.evtx Event 4781 (rename)
• "What file did you access?" -> Check MRU, Recent files, Shellbags

Example bot flow:

Bot: "TIER 1: Which account used for online search?"
-> Answer from Edge history showing Bing/Google searches

Bot: "TIER 2: Which account name did you change?"
-> Answer from Security event log (account rename events)

Bot: [Grants access] "Website: http://x.x.x.x:5000, Username: mehacker, Password: flaghere"

Key insight: Bot responses may reveal:

• Attacker's real identity/handle
• Credentials to secondary systems
• Direct flag components
• Links to hidden web services

FEC Political Donation Research

Pattern (Shell Game): Track organizational donors through FEC filings.

Key resources:

• FEC.gov - Committee receipts and expenditures
• 501(c)(4) organizations can donate to Super PACs without disclosing original funders
• Look for largest organizational donors, then research org leadership (CEO/President)

Wayback Machine

# Find all archived URLs for a site
curl "http://web.archive.org/cdx/search/cdx?url=example.com*&output=json&fl=timestamp,original,statuscode"

• Check for deleted posts, old profiles, cached pages
• CDX API for programmatic access to archive index

WHOIS Investigation

# Basic WHOIS lookup
whois example.com

# Key fields to extract:
# - Registrant name/email/org (often redacted by privacy services)
# - Creation/expiration dates (timeline correlation)
# - Name servers (shared hosting identification)
# - Registrar (can indicate sophistication level)

# Historical WHOIS (before privacy was enabled)
# Use SecurityTrails, WhoisXML API, or DomainTools
curl "https://api.securitytrails.com/v1/domain/example.com/whois" \
  -H "APIKEY: YOUR_KEY"

# Reverse WHOIS — find all domains registered by same entity
# Search by registrant email, org name, or phone number
curl "https://reverse-whois-api.whoisxmlapi.com/api/v2" \
  -d '{"searchType":"current","mode":"purchase","basicSearchTerms":{"include":["target@email.com"]}}'

# IP WHOIS (find network owner)
whois 1.2.3.4
# Look for: NetName, OrgName, CIDR range, abuse contact

# ASN lookup
whois -h whois.radb.net AS12345
# Or use bgp.tools: https://bgp.tools/as/12345

Key insight: WHOIS data is most useful for timeline correlation (when was the domain registered relative to CTF events?), reverse lookups (what other domains share the same registrant?), and identifying shared infrastructure. Historical WHOIS via SecurityTrails or Wayback Machine can reveal pre-privacy registrant details.

---

Resources

• Shodan - Internet-connected devices
• Censys - Certificate and host search
• VirusTotal - File/URL reputation
• WHOIS - Domain registration
• Wayback Machine - Historical snapshots