WOsint - OSINT CTF Write Up
6 min read

WOsint - OSINT CTF Write Up

WOsint - OSINT CTF Write Up

This was a french CTF, organized by 0xW00dy and Itarow. The goal of this CTF was to introduce OSINT, GEOINT and Social Engineering by making easy and medium challenges.

OSINT

D-Rating

In May 2020, the D-Rating company published a report on a study of cyber security in banks in Europe. Find this report.
Flag : Last word of the PDF

So, I look for the D-Rating company and check their articles.

But there were no articles between April and November. So I used archive.org to see if I could retrieve the articles but it didn't work.

After searching on this missing article, I found this following information on this website : https://www.lesfurets.com/banque/actualites/banques-francaises-mal-protegees-contre-la-cybercriminalite

"The D-Rating study, published on June 24th of this year, takes stock of the means implemented by banking institutions to counter this cybercrime. It is the result of a survey conducted between March 1st and May 11th, right in the heart of the crisis."

So, I look for the 24th June.

The second website have a link to the PDF.

Last page of the PDF.

Flag : activity

Mon beau bateau (EN: My beautiful boat)

Will you be able to find the name of the first owner of this boat?
Flag: Name_FirstName

GV (in GV730709) stands for the port of the boat, here it's Guilvinec. Let's find the boat thanks to his registration :

On this PDF, we can see that the vessel is named L'OCARINA, the old name of this boat was Nevez Amzer. Let's search for the owner (armateur in french) of this boat.

http://navires-de-peche.over-blog.com/article-23249563.html

Flag : JOLIVET_Philippe

Mon beau bateau 2 (EN: My beautiful boat 2)

Find the ID of the boat.
Flag : ID

Boats are often identified by their Maritime Mobile Service Identity (MMSI). Let's find the MMSI of the boat thanks to its name.

Flag : 228126000

Mon Beau Bateau 3

On November 19, 2020, the boat arrives at the port of Guilvinec. However, the captain does not remember how long it stayed there... Can you help him?
Flag: dd:hh:mm

Thanks to the MMSI, we can look the port calls of this boat.

https://www.myshiptracking.com/vessels/f-v-l-ocarina-mmsi-228126000-imo-0

Flag : 00:16:52

Dark Lover

Find the name of the professor teaching badminton at the IUT of Vannes in 2015.
Flag : NAME (without accents)

We know that this professor was teaching badminton in 2015. The website of the IUT of Vannes is iutvannes.fr. Let's use a google dork to target this domain :

The second links contains 2015 in it, let's check it out. They are two professors teaching badminton, Cabanes and Lesné. The format of the flag is marked as "no accent".
So we can assume that the anwser is Lesne.

Flag : LESNE

Dark Lover 2

Find the second professor's landline phone number at the IUT of Vannes.
Flag : Phone number

So we need to find the phone number of M. Cabanes. We have a hint about the year 2014.

Flag : 0297626301

C'est Marseille bébé (It's Marseille honey)

My friend Axel drove by a billboard in May 2008 but couldn't retain the brand... Can you find out which brand caught his attention?
Flag : Company name of the brand

Marseille is a french City.
In this photo we have two informations:

  • The text on the board : TUNNEL Prado - Autoroute A50
    (autoroute = highway) A50 is the name of the highway and Prado the name of the tunnel.
  • The logo on the right side of the image belongs to the Société Générale (a french bank).

It's time for google maps. After looking around Marseille in the street mode view, I found the place thanks to the two informations above :

Now we need to found what brand caught his attention. Let's take the road backward.

Found it !

The brand is Chanel.
Flag: chanel

GEOINT

Egnaro-nuisic

Find out which historical figure is buried here.
Flag : FIRSTNAME-NAME

I used the reverse image search tools of google, bing, yandex and others but it didn't work at all.

There was a clue about the challenge, the character came from the Vendée (a French region). Afterwards, I looked at which well-known personalities came from this region.

http://www.vendee.fr/Culture-et-patrimoine/Patrimoine/11052-Les-personnages-qui-ont-marque-l-histoire-de-la-Vendee/Les-personnages-qui-ont-marque-l-histoire-de-la-Vendee

"In Vendée, everything speaks about Clémenceau: from the family castle of Aubraie to her tomb in Mouchamps."

https://fr.wikipedia.org/wiki/Tombe_de_Georges_Clemenceau

Flag : GEORGES-CLEMENCEAU

Ditë

Find the place where this picture was taken.

I searched the name of the challenge, the word was of Albanian origin.

In the background of the photo we can see a Plaza hotel, so I looked for these hotels in Albania.

Then, I look around this hotels in google street to find where the photo was taken.

Flag : PLACE-SKANDERBEG

Da-boo-dee

Retrieve the name of the club belonging to this stadium.

We can see the logo of the stadium on the left side of the image. After that, I searched which stadium was represented by a dragon.

Flag : FC-PORTO

Le Facteur (The Factor)

Nathan, to please his grandparents, has made a commitment to send them a postcard from time to time, however, he does not know the address of the post office. He only has this picture. Will you be able to find the address for him?

I look for La poste (company with the yellow logo) near Chateau de la vallière and Cooperative Agricole de la Lande.

Let's look at the street view !

Flag : Channay_sur_Lathan_Place_de_lEglise

Social Engineering

I edit the description of the challenge to not leak names or email address.

Pretend to be John Doe and retrieve the list of members of the association ! But the community manager of the association at the IUT of Vannes is aware of the good practices concerning e-mails...
Email : asso.iut-vannes@gmail.com

I looked for the person in charge of the website of the IUT of Vannes and I created a fake email address, john.doe@gmx.com, to pretends to be John Doe.

Then, I sent an email to asso.iut-vannes@gmail.com simulating that the person who manages the communication at the IUT of Vannes needs the list of members for a new article on the website.

I got a reply from the email I sent that contains the flag.

Flag : VotezBrhackage

Enjoying these posts? Subscribe for more