OSINT CTF Writeup: Open Source Intelligence Techniques

OSINT CTF challenge walkthrough using Google dorking, reverse image search, social media investigation, geolocation, and Shodan to track down hidden flags.

OSINT (Open Source Intelligence) challenges ask you to find information about a target — a person, location, organization, or digital artifact — using only publicly available sources. No exploits, no brute force; just methodical research, creative searching, and the right tools applied in the right order. These challenges mirror real-world investigative techniques used by journalists, security researchers, and threat intelligence analysts. If you’ve never done OSINT before, CTF challenges are one of the best introductions: the scope is bounded, the flag confirms you’re right, and the techniques you learn translate directly to professional practice.

Common Challenge Types

OSINT challenges come in several recurring flavors. Knowing which type you’re dealing with shapes your entire investigation strategy.

• Image geolocation: You’re given a photo and asked to identify the exact location, building, or coordinates where it was taken.
• Person profiling: You’re given a name, alias, or partial identity and asked to find a specific piece of information — an email address, employer, or something they posted online.
• Username tracking: You’re given a handle and asked to find where else that person appears across the internet and what they’ve revealed about themselves.
• Deleted content recovery: A page or post has been removed, and you need to retrieve its contents from an archive or cache.
• Infrastructure investigation: You’re given a domain or organization name and asked to find exposed services, open ports, or misconfigured endpoints.

Investigation Workflow

Follow this structured workflow for every OSINT challenge. The order matters — rushing to specialized tools before completing basic recon often causes you to miss obvious findings.

1. Document everything you've been given

   Before touching any tool, write down every piece of information in the challenge: names, usernames, URLs, image filenames, dates, and any flavor text in the description. These are all potential leads. Note what format the flag takes so you recognize it when you find it.

2. Extract metadata from any provided files

   Run exiftool on every image, document, or file attachment. Authors frequently embed GPS coordinates, device information, timestamps, and author names in file metadata — sometimes intentionally as part of the puzzle, sometimes accidentally as a shortcut to the solution.

   exiftool challenge_image.jpg
   

   Look for GPS Latitude, GPS Longitude, Author, Creator, Comment, and Software fields. If GPS coordinates are present, paste them directly into Google Maps or Google Earth.

3. Perform reverse image search

   Upload any provided images to multiple reverse image search engines. Different engines index different sources, so using all three significantly increases your coverage.

   • Google Images (images.google.com) — best for mainstream web content and news photos
   • TinEye (tineye.com) — best for tracking the original source of an image
   • Yandex Images (yandex.com/images) — often outperforms Google for landmark and building identification, particularly for non-English locations

   If the image contains text, signs, logos, or distinctive architecture, crop tightly around those elements and search again. Yandex is especially strong at matching partial scenes and oblique angles of buildings.

4. Run Google dorks against the target

   Google’s advanced search operators let you scope queries precisely. Use them to find pages, documents, and cached content that a normal search would bury.

   site:pastebin.com "CTF_USERNAME"
   site:github.com "flag{" "CTF_CHALLENGE_NAME"
   inurl:admin site:target.com
   intitle:"index of" site:target.com
   

   Combine operators for tighter targeting. site: restricts results to a specific domain, filetype: finds specific document types, inurl: matches text in the URL itself, and intitle: matches against the page title — useful for finding open directory listings that may expose challenge files or artifacts.

   Try wrapping the exact challenge username or alias in quotes and searching without any operators first. Sometimes a single direct hit surfaces the answer before you need to reach for dorking.

5. Enumerate the username across platforms

   If you have a username or handle, check it across every major platform manually or with a script. Even if the main account is deleted, a secondary platform may still have posts, a bio, or a linked site containing the flag.

   import requests
   
   username = "ctf_player_name"
   headers = {"User-Agent": "Mozilla/5.0 (compatible; CTF-OSINT/1.0)"}
   
   sites = [
       "https://github.com/{}",
       "https://pastebin.com/u/{}",
       "https://reddit.com/user/{}.json",
       "https://keybase.io/{}",
       "https://dev.to/{}",
   ]
   
   for template in sites:
       url = template.format(username)
       try:
           r = requests.get(url, headers=headers, timeout=5, allow_redirects=True)
           if r.status_code == 200:
               print(f"[+] Found: {url}")
           elif r.status_code == 404:
               print(f"[-] Not found: {url}")
       except requests.RequestException as e:
           print(f"[!] Error for {url}: {e}")
   

   A 200 response doesn’t always mean the account exists — some platforms return 200 for “user not found” pages. Always open confirmed hits in a browser to verify the account is real and active. The Reddit .json endpoint is reliable: it returns 404 for non-existent users and genuine JSON for real ones.

   Tools like Sherlock and Maigret automate this across hundreds of platforms. Run them first, then follow up manually on any hits.

6. Search Shodan for exposed infrastructure

   If the challenge gives you a domain name, IP address, or organization name, use Shodan to find what services are publicly exposed. Shodan indexes banners, certificates, and response headers from internet-facing services worldwide.

   hostname:target.com
   org:"Target Company" port:22
   ssl:"flag{" 200
   

   The ssl: filter is particularly powerful in CTF scenarios — challenge authors sometimes embed the flag directly in a TLS certificate’s common name or subject alternative names. The 200 at the end filters for hosts returning HTTP 200, cutting out unreachable services.

   Shodan’s free tier limits the number of results and filters available. Most CTF OSINT challenges are solvable with the free tier, but if you’re hitting walls, the academic discount makes a paid account very affordable.

7. Check the Wayback Machine for deleted content

   If a URL is referenced in the challenge but returns a 404, or if you suspect content has been deliberately removed, check the Internet Archive’s Wayback Machine at web.archive.org. Enter the full URL and browse available snapshots by date.

   Pay attention to the snapshot calendar — the dates of available captures can themselves be a clue. If captures suddenly stop, something was likely taken down intentionally. Check the last few snapshots before the gap.

   Also check archive.ph and cachedview.nl as alternative caching services. You can query the Wayback Machine’s CDX API programmatically to list all snapshots for a URL:

   curl "http://web.archive.org/cdx/search/cdx?url=target.com/secret&output=text&fl=timestamp,statuscode"
   

   This returns every snapshot ever taken for that path, along with the HTTP status code at capture time — a quick way to confirm a page existed and when it disappeared.

Reverse Image Search Deep Dive

Reverse image search is often the fastest path through an image geolocation challenge. The technique is simple, but the results vary dramatically depending on which engine you use and how you crop the input image.

Google Images

Google Images works best when the subject of the photo is well-represented on the English-language web — famous landmarks, news events, product photos, and memes. Drag and drop the file onto images.google.com or click the camera icon to upload.

When results aren’t helpful, try these refinements:

• Crop to the most distinctive element in the image (a sign, a logo, a specific architectural feature)
• Use Google Lens for scene recognition and text extraction
• Search for any readable text in the image as a regular text query

TinEye

TinEye specializes in finding the original source of an image and tracking where it has been reused or modified. This is valuable when a challenge image is a screenshot of a social media post or a photo lifted from a specific blog — TinEye can point you directly to the original URL.

TinEye also shows you the earliest date it indexed an image, which can help establish a timeline for the challenge scenario.

Yandex Images

Yandex consistently outperforms Google and TinEye for identifying buildings, street scenes, and geographic locations — especially outside North America and Western Europe. Upload the image at yandex.com/images and click the camera icon.

Yandex’s scene recognition is particularly strong. It will often identify the specific city district, building, or street intersection visible in a photo where Google returns only country-level results.

Google Dorking Reference

Google search operators unlock results that standard queries miss. Combine them freely — most operators can be chained in a single query.

Operator	Example	What it does
site:	site:github.com username	Restrict results to a specific domain
filetype:	filetype:pdf "confidential"	Find files of a specific type
inurl:	inurl:backup site:target.com	Match text in the URL
intitle:	intitle:"index of" passwords	Match text in the page title
before: / after:	before:2023-01-01 site:target.com	Filter results by date range
"exact phrase"	"flag{" site:pastebin.com	Require an exact string match
-term	target.com -www	Exclude pages containing a term

Some Google dork queries — particularly those targeting login pages or exposed files on real domains — may trigger rate limiting or CAPTCHA. Use them responsibly and only against challenge-provided targets.

Tools Reference

OSINT Tools Cheat Sheet

Reverse Image Search

• Google Images — general-purpose, strong on English-language content
• TinEye — tracks image origin and reuse history
• Yandex Images — best for landmark and geographic identification

Username Enumeration

• Sherlock — checks 300+ platforms from the command line
• Maigret — deep username search with profile aggregation
• WhatsMyName — web-based username search with live results

Metadata Extraction

• exiftool — extracts metadata from images, PDFs, Office documents, and audio files
• mat2 — strips metadata (useful for understanding what would be present)
• Jeffrey’s Exif Viewer — web-based EXIF viewer with GPS map integration

Infrastructure and Domain Research

• Shodan — search engine for internet-connected devices and services
• Censys — TLS certificate and host enumeration
• VirusTotal — passive DNS, domain relationships, and file analysis
• whois — domain registration history and registrant information

Cached and Archived Content

• Wayback Machine — historical snapshots of web pages
• archive.ph — on-demand page archiving and retrieval
• before:/after: Google operators — filter results by publication date range

Geolocation

• Google Maps — paste GPS coordinates directly into the search bar
• GeoGuessr — training tool for visual geolocation skills
• Overpass Turbo — query OpenStreetMap data for specific features

Build a personal OSINT checklist and run through it at the start of every challenge. Consistency beats inspiration — the winning move in OSINT is usually the third tool you try, not the tenth.