Massacar — Athena Trace 2026 Writeup

Content note

This challenge concerns the Tadamon massacre — a documented mass killing of civilians in Damascus, Syria, in April 2013, and the site where it took place.

This writeup deals only with the geolocation methodology. It does not reproduce the challenge artifact, does not describe the contents of the evidentiary video material, and does not discuss the killings beyond what is necessary to explain how the location was established. The victims were real people and the site is a grave. Readers looking for documentation of the events themselves should go to Human Rights Watch and the investigative reporting on the case rather than to a CTF writeup.

The challenge

The artifact shows a photograph of a crowd gathered at that site. At a Security Council stakeout, a delegate held a photograph up to the cameras. Nobody read out where it was taken. Find the alley.

Flag format: trace{lat, long} — decimal degrees, exactly 4 decimal places (keep trailing zeros), comma separated, no space.

Rated Insane, 800 points. It took me 195 attempts — and almost none of that was research.

The chain

The prompt describes a specific, findable media event: a delegate holding a photograph up at a Security Council stakeout, without stating where the photo was taken. Stakeouts are transcribed and indexed, so this is a searchable event rather than a needle.

The search resolves to the Syria stakeout of 24 April 2026, which establishes the country and the context. From there the chain is short:

1. Stakeout → Syria. The session identifies the subject.
2. Syria + massacre site + crowd gathered at a grave → Tadamon. The Tadamon massacre (Damascus, April 2013) is the documented case that matches.
3. Tadamon → Human Rights Watch documentation. HRW and the associated investigative reporting geolocated the site from video evidence, establishing the specific alley in the Tadamon district.
4. Alley → coordinates.

That’s it. As I said to a friend afterwards: it’s basically easy if you watch the videos. The research was never the hard part.

Where the 195 attempts went

The hard part was step 4, and it wasn’t a research problem at all.

I had the alley. HRW’s work pins it, and the surrounding streets are identifiable in satellite imagery. What I did not have was the answer to a different question: which point in that alley did the setter treat as correct?

At four decimal places the tolerance is roughly 11 metres. An alley is a segment, tens of metres long. So “the alley” has many defensible coordinates:

• the midpoint of the segment
• the junction where it meets the through-street
• the position identified in the video geolocation
• the centroid of the block

Each is a reasonable reading of “find the alley”. Each produces a different flag. I worked through them in ten-thousandth-of-a-degree steps, which is exactly as productive as it sounds.

The actual anchor

The ground truth was not any of my geometric readings. It was a named Google Maps POI.

A user-created place exists at the site: موقع مجزرة التضامن — “site of the Tadamon massacre” — at plus code F8J8+57, Damascus. Google has it filed, in one of those quirks of crowd-sourced map data, under the category college, with a star rating and a handful of reviews.

The setter took the coordinate from that pin.

Once you know that, the answer is a lookup rather than an estimation problem. And the lesson generalises well beyond this challenge:

When a geolocation flag demands high precision, the first question is not “where is this place” but “what object did the setter read the coordinate off”. Setters build challenges from tools, and the tool that produces a copy-pasteable decimal coordinate is a map pin. Before estimating from imagery, search the target area for a named POI — memorial, landmark, user-created place — and check whether its pin satisfies the format. Estimating geometry from satellite view should be the fallback, not the opening move.

For a site like this, a user-created memorial POI is particularly likely to exist and particularly likely to be what a setter finds first.

A note on the format changes

Worth recording, because it explains part of the attempt count and reflects on the challenge design rather than the solvers.

The required precision was reduced twice during the CTF — from six decimal places, to five, and finally to four. Six decimal places is roughly 0.1 m. No public geolocation of an alley supports that, and neither does a Google Maps pin; you cannot get there from open sources, only from the setter’s exact clipboard contents.

The progressive relaxation is effectively an acknowledgement that the original specification wasn’t satisfiable. If you were grinding attempts early on, some of those were against a target that could not be hit.

Two things follow. For solvers: when a precision requirement looks physically implausible for the evidence available, that instinct is worth trusting — check whether the task has been amended before assuming your method is wrong. For setters: precision demands should be derived from what the evidence supports, not from what the source tool happens to print.

Flag

trace{33.4802, 36.3152}

Closing note

The methodology here is ordinary geolocation work. The subject is not. The techniques described above — stakeout transcripts, NGO video verification, satellite cross-referencing — are the same ones used by the investigators who established what happened at Tadamon and who worked to identify the victims. That work matters, and it is worth reading on its own terms.

Sources and credits

The challenge artifact is a United Nations photograph and is not reproduced here. Site verification draws on Human Rights Watch’s documentation of the Tadamon case. Map data © Google.