Private WiFi II: One Street Photo to a London Pub's Wi-Fi Password

Title: Private WiFi II 🛜

Description: Geolocate where this photograph was taken and investigate the immediate surroundings. Somewhere nearby, there is a Wi-Fi network with an exposed password. Using only publicly available information, find the SSID and the WiFi password.

Flag: Hacktoria{SSID_WiFiPassword}

The answer, up front: the photo is the corner of Lower Marsh and Westminster Bridge Road, London SE1, outside The Walrus Bar & Hostel, under the Waterloo railway viaduct — 51.499934, -0.114333 (the position of the Apple Look Around panorama the photo was taken from, so good to a few metres). The pub tapes its guest Wi-Fi to the wall behind the bar, QR code and all, so the flag is Hacktoria{Walrus Free_Walruswifi1}.

If that’s all you came for, you’re done. The rest is the route — including the advert that isn’t a location clue, the hour I gave to the wrong country, the Street View corner that matched everything and still wasn’t the frame, and the second Wi-Fi network the challenge author had in mind.

Everything the challenge hands you. Faces already pixelated by the author. The people don’t matter — the fixed furniture of the street does.

Step 1 — Read the picture before touching a tool

No EXIF, no map, no caption. So inventory what’s actually in frame and, more importantly, sort each clue into fixed to this spot or just passing through.

Fixed to the spot:

• A stone-fronted building on the right — large, smooth, pale ashlar blocks with barred sash windows. Reads like a converted bank, which in the UK almost always means a pub or a chain restaurant now.
• Picnic benches and a slatted timber planter-screen on the pavement — pub or café seating.
• Wide paving with tactile paving studs (the “braille” bumps) at the kerb — a controlled crossing, a junction, a traffic-light pole.
• A dark mass filling the right background behind the van. Not just shadow — a structure. A tunnel, a bridge, or a building mid-refit under sheeting.
• A black traffic-signal pole and a central refuge island with a bollard.

Just passing through:

• The white Wallington Cars & Couriers van, “020 8401 020…”. A London courier — but couriers drive everywhere, so this dates and regionalises the shot at best, it doesn’t pin it.
• The red ”…‘s Fermented Hot Sauce … Deli…” advert with a global logo bottom-left.

That advert nearly cost me. More on it in a moment.

Step 2 — The van narrows the region (a little)

Wallington Cars & Couriers has a public site with a service-area page: Croydon, Sutton, Mitcham, Wimbledon, Kingston, Surbiton, New Malden. That’s south and south-west London. Useful as a nudge, worthless as proof — a courier van in shot is one of the weakest geolocators there is. I logged it as “lean south London” and moved on rather than treating it as fact.

It pays off later in a different way: a courier based in Croydon or Sutton that turns up in central London has driven in on one of the radial routes, and those routes run under and alongside the railway lines into the London termini.

Step 3 — The advert is a trap

The red panel reads like a brand name ending in ‘s, then FERMENTED HOT SAUCE, then a “global” logo. I burned real time here: was it Kold Sauce (a London fermented-sauce brand sold in delis)? Billy B’s? Burger & Sauce? Each half-fit the letter shapes.

The mistake was treating a printed panel as a location clue at all. Zoom in and the panel has red borders, a dark band above it, and a blurred face in a window above the panel: it’s the side of a double-decker bus, and “Global” is the outdoor-media company that sells bus and billboard space. A bus is the definition of not fixed to this spot. The advert dates the photo and tells you it’s a UK city with Global bus contracts — nothing more.

Lesson, filed: anything on a vehicle — van livery, bus advert — is a passenger, not a landmark. Grade it as evidence of when/where-ish, never where.

Step 4 — Granite, and an hour lost to Scotland

The stone bothered me. Big, smooth, pale-grey ashlar blocks — that’s not the yellow-stock brick or Portland render you expect in central London. Grey granite has a strong regional tell in the British Isles, and I cross-checked it against the Plonk It UK guide:

Plonk It’s UK building-stone reference: grey granite is the Aberdeen tell. True, and the wrong question for this photo.

Granite ⇒ Aberdeen. Red sandstone ⇒ Glasgow/Dumfries. Yellow sandstone ⇒ Edinburgh. So I pivoted to Aberdeen, pulled every city-centre pub and bar out of Overpass, and walked the Union Street granite frontages in Street View looking for the benches and the planter. Archibald Simpson, SOUL, Whelans, the Holburn — none matched.

The pivot was wrong, and here’s the honest reason: I let one strong feature (stone colour) overrule several others (a London courier, a UK bus advert, the whole feel of the street). The granite is real, but London does use grey ashlar on its grander Victorian commercial buildings, especially former banks. Grading note: when one clue drags you to a different country than the rest, that’s a flag to re-weight, not to commit. I committed. About an hour gone.

Step 5 — Back to London, and follow the trains

Reset to London and re-ranked the fixed clues: a former-bank pub, a junction with tactile paving and a refuge island, and — the one I’d under-used — that dark overhead mass. In London a dark structure straddling a road, next to a pub, next to a crossing, is very often a railway viaduct. The UK is threaded with them, and the arches are dark, sooty, exactly like the frame’s right side.

So the search became: pubs and bars hard up against a rail bridge, in the inner city, where the courier from Step 2 would be driving through. I did it by eye on the map along the viaducts into the termini. This Overpass query reproduces that search in one go (overpass-turbo):

[out:json][timeout:120];
// central London: roughly the Congestion Charge zone plus the South Bank
way["railway"="rail"]["bridge"~"^(yes|viaduct)$"](51.490,-0.180,51.530,-0.070)->.bridges;
nwr["amenity"~"^(pub|bar)$"](around.bridges:25);
out center tags;

It returns 82 pubs and bars, and The Walrus is one of them. Note the viaduct: the lines into Waterloo are tagged bridge=viaduct, not bridge=yes, and a filter on yes alone misses the answer entirely. Eighty-two candidates is a list you can walk in Street View. The picnic benches, the planter screen and the granite frontage cut it quickly, and the paving in Lower Marsh matched: the specific granite-sett kerb and slab layout.

Google Street View at that corner then matched almost everything:

Google Street View, July 2024: every circled fixture matches, from the no-entry sign to the paving joints. Same corner, but no Google panorama stands where the challenge camera stood.

The wall, the no-entry sign, the refuge island, the ground, the tactile paving, the black signal pole, even the darkness of the arch. It ticked every box, and it still wasn’t the frame: the angle and the height were wrong, and no Google panorama reproduced the view. A pile of matching features is not a match until the arrangement lines up. I nearly called it there.

Step 6 — Mapillary no, Apple Look Around yes

Google Street View wouldn’t give me the exact vantage — the photo is shot from slightly elevated, gently fisheyed. That’s a tell for a survey-camera capture, so I checked the other street-level imagery sources.

• Mapillary: no coverage that matched.
• Apple Look Around (via lookmap, which exposes Apple’s panoramas with a shareable link; that link opens the exact panorama and heading): a 100% match.

Apple Look Around, 15 March 2023, panorama position 51.499934, -0.114333. Not just the street: the same van, the same pedestrians and the same pram. The challenge photo is a crop of this panorama.

Same van, same “Bar Hostel / Lower Marsh SE1” granite frontage, same benches, same viaduct, same people, down to the Six Nations 2023 board in the window, which fits a panorama shot three days before the 2023 tournament’s final round. The challenge photo is an Apple Look Around frame. Corner of Lower Marsh and Westminster Bridge Road, and the building on the right is The Walrus Bar & Hostel.

Geolocation done: 51.499934, -0.114333, the panorama’s own position, so the camera spot to within a few metres.

Step 7 — “Investigate the surroundings” — the Wi-Fi

Now the second half: a nearby network with an exposed password.

My first instinct was WiGLE, the wardriving database — map the SSIDs at the corner. Two problems: I hit the daily query limit immediately, and more fundamentally, WiGLE stores the SSID and BSSID, never the password. Wrong tool for the password half. It would only confirm a network name I could read anyway.

WiGLE at the corner: the daily limit hit before a single network showed. Not a loss. WiGLE has no password field to find.

So back to the most under-rated OSINT source there is: the venue’s own Google Maps photos, and its own website. The Walrus is a bar as much as a hostel, and it photographs its interior heavily.

Two finds. First, the reception amenity chalkboard behind the bar lists an SSID in cursive:

That gives WalrusBar Free WiFi — a network name, but no password. It’s the decorative board, not the credentials.

The credentials were on a second sign, laminated to the wall and photographed by a guest — a QR poster with the fields printed in plain text underneath:

• Network: Walrus Free
• Password: Walruswifi1

The whole point of the challenge — “an exposed password… publicly available information” — and the pub had laminated it to the wall, in a photo sitting on its own Google listing.

Step 8 — Verify: the QR, then a second sign, then the author

Two different signs gave two SSIDs (WalrusBar Free WiFi vs Walrus Free). The QR on the poster encodes the real network config as WIFI:S:<ssid>;T:<auth>;P:<password>;;. My local decode failed — glare sat right on the top-left finder pattern — so I ran the poster through an online QR reader:

The QR agrees with the print: Walrus Free / Walruswifi1, WPA, not hidden.

That settles what the poster says, but it is the same poster saying it twice. The independent check is a different sign in a different photo: a guest’s picture of a dorm bed on the same Google listing, posted in August 2026, with the hostel’s house-rules card hanging off the frame:

The dorm-bed card, August 2026: same SSID, same password, printed separately from the bar poster. The network was still current a month before the challenge.

The chalkboard’s WalrusBar Free WiFi is just a different label; the connectable SSID is Walrus Free.

The network the author meant

When I submitted, the challenge author came back with “I’m seeing a different WiFi”. Their intended answer was a third network, Guest, with a password the venue had posted on Facebook in May 2026. So the Walrus has at least three names in public: WalrusBar Free WiFi on the chalkboard, Walrus Free on two printed signs, and Guest on Facebook.

What decided it was the dates. The bed-card photo from August 2026 is newer than the Facebook post, and nothing shows Walrus Free being retired, so the author accepted it. The honest reading is that the challenge has two valid answers, and the flag format (SSID_WiFiPassword) doesn’t say which one it wants.

Flag

Hacktoria{Walrus Free_Walruswifi1}

Accepted, on the strength of the August 2026 photo; the author’s own answer used the Guest network from the venue’s Facebook page. To be clear about the boundary: this is a passive, read-only exercise. The password was made public by the venue itself; nothing was connected to, and no network was touched.

What I’d tell myself before starting

• Sort every clue into fixed vs passing. The van and the bus advert are passengers. The building, the paving, the viaduct and the junction are the street. I let a passenger (the advert) and a single over-weighted feature (granite) each pull me sideways.
• One strong clue that disagrees with the rest is a warning, not a verdict. Granite screamed Aberdeen; everything else said London. The majority was right.
• A bag of matching features isn’t a match. The near-miss corner on Lower Marsh had every element and still wasn’t the frame. Wait for the arrangement to line up.
• When Street View fails on a survey-style photo, try Apple Look Around and Mapillary. One of them closed this in a single panorama.
• Right tool per half. WiGLE for an SSID, never for a password. For the password, the venue’s own photos and website beat any wardriving database.
• Check the venue’s social accounts, not just Google. The author’s answer was on Facebook; mine was in Google Maps photos. A place that prints its Wi-Fi once usually prints it in several places, and not always the same network.
• Date every source when there’s more than one answer. Three SSIDs for one pub is normal. The newest dated photo is the argument that decides it.

Sources

• Wallington Cars & Couriers — areas we cover — the south-London service area behind the van
• Plonk It — United Kingdom — the building-stone meta behind the Aberdeen detour
• overpass-turbo — runs the Step 5 query
• lookmap — the Apple Look Around panorama — the frame itself, 15 March 2023
• WiGLE — the wardriving database, and why it can’t answer the password half
• The Walrus Bar & Hostel on Google Maps: the Wi-Fi poster and the dorm-bed card, August 2026