OSINT Industries runs a CTF of passive-OSINT challenges, from single-image solves to multi-stage chains across PDFs, social profiles and audio. These are my writeups. Each one gives the answer near the top, then the method, including the dead ends.
A ten-second solve of the OSINT challenge A Taste of Influence Part 1: the flag was in the Gronda profile picture, and the stylised logo pins the year.
Part 2 of the A Taste of Influence OSINT challenge: name to city to business project to a pre-GDPR WHOIS record, and why the phone number is the part that matters.
The final part of the A Taste of Influence OSINT challenge: finding a subject's Strava account through public athlete search, and disambiguating on the profile photo.
A hand-drawn QR code carries two payloads: one is the vault, the other is the keys. The chain opens as a supermax jailbreak and closes somewhere much stranger.
ProtonMail never publishes account creation dates. It publishes a PGP key for every address, and that key carries a timestamp. One HKP query away, and less proof than it looks.
A passive-OSINT challenge that chains white-on-white PDF text, an emoji substitution cipher, a Morse-tagged Robot 36 SSTV transmission and a QR code into a physical meeting location.
A pixelated boarding pass, a perfectly readable PDF417 barcode, and neither of them mattered. The solve took sixty seconds — and the only real trap in the challenge had nothing to do with the censoring.