The Challenge Was Called DEPIX. Depix Was the Wrong Tool.

The challenge — an OSINT Industries exercise — shipped with a name, and the name was a suggestion. DEPIX. A heavily pixelated American Airlines boarding pass, three fields to recover: passenger name, seat number, arrival airport IATA code.

Target Information

A passenger posted a photo of their flight ticket online. The ticket is heavily pixelated, but key details remain partially recoverable.

Your task is to identify:

• The passenger’s first and last name
• The seat number
• The arrival airport IATA code

All information can be deduced through lawful open-source intelligence techniques.

Objective

Using only legal OSINT methods, extract the required information from the depixelated ticket.

Your final answer must follow this exact format, in this exact order: OSINT{NAME_SURNAME_SEATNUMBER_AIRPORTIATA}

Example format (not the solution): OSINT{JOHN_DOE_14A_JFK}

The pixelation protects nothing: the PDF417 across the top was never censored, and BCBP is plaintext by design.

Up front: all three fields came from a sixty-second reverse image search that found the uncensored original — seat 3D, destination PVG. Depix never ran. That’s the point of this writeup.

Two obvious paths present themselves. Both are wrong.

The path the name suggests

Depix recovers text from pixelated images, and it genuinely works — under conditions this image does not meet. It needs a screenshot of digitally rendered text, a linear box filter, and a search image built from the identical font, size and rendering pipeline. It reconstructs by matching the averaged blocks against a rendered reference.

This was a phone photo of thermal paper held in someone’s hand, shot at an angle, under mixed lighting. There is no font to match and no rendering pipeline to reproduce. Depix has nothing to work with.

Worth knowing where the line sits: Depix against a Windows screenshot of a pixelated password is a demo that lands. Depix against a photograph of a physical object is not a harder version of the same problem, it’s a different problem.

The path the image suggests

The barcode across the top was never censored. It’s a PDF417 carrying an IATA BCBP payload (Resolution 792), and that format is plaintext by design:

M1CH**/MICHAEL        EON**** LAXPVGAA 0183 160F003D0042 100

(Surname and PNR masked in this reproduction — see the note under the flag.)

Name, origin, destination, carrier, flight, seat — all of it, sitting in a field that people forget to censor because it doesn’t look like text. That’s a real and underappreciated finding: censoring a boarding pass while leaving the barcode visible accomplishes nothing.

So this looked like the intended route. It wasn’t.

What actually worked

Reverse image search. Sixty seconds, uncensored original, done.

The censored version was derived from a photo that was already public, and nothing in the pixelation survives contact with that fact. Whether the author placed it deliberately or the source was simply findable, the result is the same: the entire premise of the challenge was bypassable before any tooling came out.

Standard lesson, learned again — check whether the artifact exists elsewhere before you attack the artifact. Redaction protects the copy you redacted, not the original.

The part that was actually hard

Here’s the field that catches people, and it has nothing to do with pixels.

Bottom right of the pass, in large clear type:

49U   /LAX

LAX. Three-letter IATA code, clearly printed, sitting alone in a box. Every instinct says that’s your arrival airport.

It isn’t. Look at what’s directly above it: PLACE OF ISSUE — LOS ANGELES. That block is the ticketing office. 49U is the office identifier, LAX is where the ticket was issued.

The actual route is two lines up, in the smaller print:

FROM  LOS ANGELES
TO    SHANGHAI PUDONG
AA 183   F   09JUN 230P

Shanghai Pudong. PVG.

Note that the barcode route would have caught this too — LAXPVG is unambiguous. But anyone who solved it by reading the recovered image, as most people did, had to notice that the largest and clearest IATA code on the document is decoration.

That’s the one piece of genuine tradecraft in the challenge: on a legacy AA ticket stock, the most prominent airport code is not the destination. Documents have layout conventions, and prominence is not relevance.

Flag

OSINT{MICHAEL_C____3D_PVG}

Surname partially withheld here. The flag as submitted contains it in full; there’s no reason for a public writeup to add another indexed copy of a private individual’s name, seat assignment and PNR. If the image is the author’s own — which is the reasonable read — it costs nothing. If it isn’t, it matters.

Takeaways

Challenge names are hypotheses, not instructions. DEPIX pointed at a tool that couldn’t work on this input. Read the artifact before you read the label.

The barcode is the real lesson. BCBP is plaintext. Every boarding pass photo posted publicly leaks name, route, seat and PNR to anyone with zbarimg and thirty seconds. That’s the finding worth carrying out of this one, even though it wasn’t the solve path.

Reverse image search first. Always. It costs one minute and it collapses entire categories of challenge.

Prominence is not relevance. The biggest, clearest, most confidently formatted field on a document can be the wrong one. Place of issue is not destination.

Sources

• Challenge: OSINT Industries — “DEPIX” exercise
• Depix — the tool the name points at, and its actual working conditions
• IATA BCBP (Resolution 792) — the PDF417 payload format on every boarding pass