CTF & OSINT writeups — geolocation, social media forensics, and the occasional web challenge.
Bellingcat Urban Exploration. An ordinary German street with parked cars and no street sign. Number plates narrow it to the Rhine-Main area, a fabric shop and a mattress store each have one branch that fits, and both are on Stiftstraße in Frankfurt.
Bellingcat Urban Exploration. A graffiti-covered dumpster in an unnamed alley, no location metadata. Google Lens on the Goof Troop graffiti led to a 2018 Reddit post whose location comments a mod had removed — recovered via Arctic Shift to Morse Street in DC's Union Market.
Bellingcat Maritime Mysteries. A sunset over a mountain lake, no EXIF, nothing visible in the sky. Error Level Analysis in Forensically shows six digits in the clouds, and a quality sweep explains why exactly one JPEG setting reveals them.
Bellingcat Maritime Mysteries. A screenshot of a translated port log for the YUI PENG 3, the ship suspected of cutting two Baltic cables. Google Lens, a German forum, Yandex and the Wayback Machine lead back to the Russian port authority page it came from.
Hacktoria GEOINT. Eighteen seconds of bog and spruce with nothing to read in the frame. The picture leads nowhere; the soundtrack is a 2008 xeno-canto recording, and its recordist logged the exact spot on observation.org.
Bellingcat Wild Lives. Two giraffes in front of the Eiffel Tower, standing in the Seine. Paris is a pasted-in backdrop; the coat pattern points to the Masai giraffe, and its range comes down to four countries. The last step is trial and error.
Bellingcat Maritime Mysteries. A Morse transmission from the Russian tanker Yelnya on the Black Sea. Morse gives five-digit groups, the call sign leads to an X post, and the WMO ship code turns the groups into weather, with one tempting wrong answer on the way.
Bellingcat Maritime Mysteries. A container ship at the quay, no EXIF, no caption. Google Lens found the photo on a dozen sites, one of them leaked a Pexels file name, and the original on Pexels is tagged Hamburg. The cranes and the bridge in the frame confirm it.
Bellingcat Maritime Mysteries. Grey carriers at a pier, no EXIF, and no hull number on the ship in question. A pier sign, the camera position and the 2024 fleet movements narrow it to one carrier: USS George H.W. Bush.
Hacktoria GEOINT. A 2021 Street View frame with a black smoke plume over Flemish fields. Two wrong countries on the way, one search operator that mattered, and a press photo that pinned the house number.
Bellingcat Globetrotters. A blurred photo from a moving car, one Cyrillic sign and no building name. The letter Ү pointed to Kyrgyzstan, Google fixed a half-read village name, and a 2015 Street View pass pinned the junction on the A365.
Bellingcat Globetrotters. A street photo with a motorbike on a crosswalk and no EXIF. Yellow plates said Colombia, a pink dog in a shop window led to one vet clinic on Carrera 7, and Street View turned around to the bust the photo leaves out.
Bellingcat Globetrotters. One photo of a sticker-covered summit box and a view over an Alpine valley. A QR code, a date search on X and a Google Maps user photo narrowed it from all of Austria to one cross.
Bellingcat Challenge. A photo of a flock of flamingos at a pool, no EXIF, no sign. Leg bands said zoo, Google Lens said Seattle, and labelled stock photos of the same enclosure confirmed it.
On 15 September I deleted fifteen finished, seeded, tested cases from SPURIA. A model with web search had solved nineteen of their twenty fields. This is how it happened, what the second attempt taught me, and which kind of answer still holds.
A practical guide to the evidence log behind an OSINT finding: the minimum fields per entry, how to capture and hash a source before you analyse it, how to log a false lead and retract it, and how the log becomes the report. With a worked example and a downloadable template.
Hacktoria GEOINT. One photo of a bp forecourt with the shop signs blurred out, and a question about when it was uploaded. A logo read through the blur, 211 candidate stations, and a delivery van that ruled out Google.
Hacktoria GEOINT. A blurred street photo, a courier van, a hot-sauce advert and a dark arch. The advert was a trap, Scotland was an hour wasted, and the answer was laminated on a wall the whole time.
A Hacktoria CTF that hands you one word and nothing else. The island was the easy part — the hard part was three empty frames in an email.
One power line voltage put me within 10 m of the answer in minutes. The rest of the day went on the assumption that "the 360 image" meant Google's.
I built a six-stage stego challenge where the key sat in Discord rather than in the file. Nobody solved it. Here is the whole chain, and the reason it broke at the first gate.
National aerial survey programmes photograph entire countries on a fixed cadence and publish the frames as open data — in Denmark's case with capture timestamps accurate to the second. When and how to use Skråfoto, PDOK, and Norge i bilder to date a scene instead of guessing.
An aerial shot of a KLM Cityhopper lifting off an unnamed runway. Runway markings give the scale, the scale gives the airport, and Denmark's open aerial imagery archive gives a timestamp accurate to the second — enough to name the exact flight and its arrival gate.
A concluded event, written up case by case. Open the event page.
A wire photo stripped of its caption. The work isn't recognising the scene — it's proving the metadata is really gone, then recovering the caption from syndication.
A patent drawing sold as wall art, cropped just above the one field you need. The answer is a database lookup keyed on the fields that survived.
One reverse image search identifies the photograph. The points are in two details on the same page: a pseudonym, and a date that isn't the date of the event.
A screened gazebo, no landmarks, no signage, no readable text. The whole challenge is knowing that the object is the index — and that the listing is the authority on spelling.
The obvious contact address is a decoy. The real one is on a platform the business posts to more often than it updates its own site — and then a trailing newline waits to eat your submission.
A four-stage chain: read vessel data off a screenshot, derive an AES key from it, pull a ZIP out of the tail of a PNG, and unlock it with the ship's own call sign.
The research chain resolved quickly. Nearly two hundred attempts went into a different problem: guessing which object the setter had anchored the coordinate to.
An OSINT wire-photo challenge that hinges less on the identification and more on two format traps: an underscore that isn't a separator, and an official spelling that most news sources get 'wrong'.
A bare 56-character string turns out to be an address. Behind it: ten million records across twenty shards, one lookup, one count, and a couple of things in the data that aren't records at all.
A misfiled photo of a Japanese motorcycle club, a UI footer that lies about the country, and a POI pin that has to be trilaterated because the plus code isn't precise enough.
A caption that names the landmark instead of the venue, a statue that vanished into an overexposed sky, and a flag that wanted the newspapers' spelling rather than the historically correct one.
A single interior photograph, nine candidate sites, and a naming convention that decides whether a correct identification still scores.
A quote, a service record, and a record-breaking climb identify the man in minutes. The challenge is realising which of his summits the question is actually asking about.
A ten-second solve of the OSINT challenge A Taste of Influence Part 1: the flag was in the Gronda profile picture, and the stylised logo pins the year.
Part 2 of the A Taste of Influence OSINT challenge: name to city to business project to a pre-GDPR WHOIS record, and why the phone number is the part that matters.
The final part of the A Taste of Influence OSINT challenge: finding a subject's Strava account through public athlete search, and disambiguating on the profile photo.
Every mainstream LSB scanner applies one bit index across all three channels. Payloads that don't follow that rule are invisible by construction — not by accident.
zsteg, Aletheia and five statistical detectors all called this file clean. The ZIP was sitting at offset 0 the whole time — hidden by splitting one bitstream across three different bitplanes.
A hand-drawn QR code carries two payloads: one is the vault, the other is the keys. The chain opens as a supermax jailbreak and closes somewhere much stranger.
ProtonMail never publishes account creation dates. It publishes a PGP key for every address, and that key carries a timestamp. One HKP query away, and less proof than it looks.
A passive-OSINT challenge that chains white-on-white PDF text, an emoji substitution cipher, a Morse-tagged Robot 36 SSTV transmission and a QR code into a physical meeting location.
Breaking a layered OSINT packet: binary-ASCII JSON, a QR code that isn't a QR code, and a Vocaroo spectrogram that hands you a Google Maps pin.
GEOINT with no image at all. A survey notebook, two shadow measurements, one timestamp — and enough solar geometry to pin one building in the Kalahari.
Hacktoria GEOINT. No EXIF, no signs, no text. Here's how I got from an unmarked Scandinavian valley down to a single building — and the shortcut I ignored for six hours.
Maritime OSINT: reading a container number off a low-resolution harbour photo, then tracing the shipping chain to identify the vessel that carried it.
A news photo captioned 'western Mogok' sent me searching the wrong town for an hour. The phrase is administrative, not geographic — and the fix came from a Google Maps review.
One LinkedIn profile, a cross-platform pivot to a travel vlog, and a single blurry frame of a concert ticket. The seat was on the ticket — the hard part was reading one character correctly.
A Flightradar24 screenshot of a USAF C-17 heading west across the Yellow Sea gets sold as proof of secret US cargo runs to North Korea. The leg history in the same screenshot says otherwise.
A pixelated boarding pass, a perfectly readable PDF417 barcode, and neither of them mattered. The solve took sixty seconds — and the only real trap in the challenge had nothing to do with the censoring.
A GEOINT writeup: geolocating a censored Street View panorama in the Italian Alps using nothing but a poem's four constraints. Why the four black squares point at the poem, not at the picture.
A GEOINT writeup: locating a Colorado wildfire from an evacuation-zone map, and why the InciWeb URL will hand you the wrong incident number. With the WFIGS query that settles it.
A single blurry photo shot from a moving train. The deduction chain landed on the right country in the first thirty seconds — and then I talked myself out of it for three hours. A GEOINT writeup about tool-induced hallucination in data-sparse regions.
Nothing matches this filter.
