CTF OSINT
Quick reference for OSINT CTF challenges. Each technique has a one-liner here; see supporting files for full details.
Additional Resources
- social-media.md - Twitter/X (user IDs, Snowflake timestamps, Nitter, memory.lol, Wayback CDX), Tumblr (blog checks, post JSON, avatars), BlueSky search + API, Unicode homoglyph steganography, Discord API, username OSINT (namechk, whatsmyname), platform false positives, multi-platform chains
- geolocation-and-media.md - Image analysis, reverse image search, geolocation techniques (railroad signs, infrastructure maps, MGRS), EXIF/metadata, hardware identification, newspaper archives, IP geolocation
- web-and-dns.md - Google dorking, Google Docs/Sheets enumeration, DNS recon (TXT, zone transfers), Wayback Machine, FEC research, Tor relay lookups, GitHub repository analysis, Telegram bot investigation
String Identification
- 40 hex chars -> SHA-1 (Tor fingerprint)
- 64 hex chars -> SHA-256
- 32 hex chars -> MD5
Twitter/X Account Tracking
- Persistent numeric User ID:
https://x.com/i/user/<id> works even after renames.
- Snowflake timestamps:
(id >> 22) + 1288834974657 = Unix ms.
- Wayback CDX, Nitter, memory.lol for historical data. See social-media.md.
Tumblr Investigation
- Blog check:
curl -sI for x-tumblr-user header. Avatar at /avatar/512. See social-media.md.
Username OSINT
Image Analysis & Reverse Image Search
- Google Images, TinEye, Yandex (faces). Check corners for visual stego. Twitter strips EXIF. See geolocation-and-media.md.
Geolocation
- Railroad signs, infrastructure maps (OpenRailwayMap, OpenInfraMap), process of elimination. See geolocation-and-media.md.
MGRS Coordinates
- Grid format "4V FH 246 677" -> online converter -> lat/long -> Google Maps. See geolocation-and-media.md.
Metadata Extraction
exiftool image.jpg # EXIF data
pdfinfo document.pdf # PDF metadata
mediainfo video.mp4 # Video metadata
Google Dorking
site:example.com filetype:pdf
intitle:"index of" password
See web-and-dns.md.
Google Docs/Sheets
- Try
/export?format=csv, /pub, /gviz/tq?tqx=out:csv, /htmlview. See web-and-dns.md.
DNS Reconnaissance
dig -t txt subdomain.ctf.domain.com
dig axfr @ns.domain.com domain.com # Zone transfer
Always check TXT, CNAME, MX for CTF domains. See web-and-dns.md.
Tor Relay Lookups
https://metrics.torproject.org/rs.html#simple/<FINGERPRINT> -- check family, sort by "first seen". See web-and-dns.md.
GitHub Repository Analysis
- Check issue comments, PR reviews, commit messages, wiki edits via
gh api. See web-and-dns.md.
Telegram Bot Investigation
- Find bot references in browser history, interact via
/start, answer verification questions. See web-and-dns.md.
FEC Political Donation Research
- FEC.gov for committee receipts; 501(c)(4) orgs obscure original funders. See web-and-dns.md.
IP Geolocation
curl "http://ip-api.com/json/103.150.68.150"
See geolocation-and-media.md.
Unicode Homoglyph Steganography
Pattern: Visually-identical Unicode characters from different blocks (Cyrillic, Greek, Math) encode binary data in social media posts. ASCII = 0, homoglyph = 1. Group bits into bytes for flag. See social-media.md.
BlueSky Public API
No auth needed. Endpoints: public.api.bsky.app/xrpc/app.bsky.feed.searchPosts?q=..., app.bsky.actor.searchActors, app.bsky.feed.getAuthorFeed. Check all replies to official posts. See social-media.md.
Resources
- Shodan - Internet-connected devices
- Censys - Certificate and host search
- VirusTotal - File/URL reputation
- WHOIS - Domain registration
- Wayback Machine - Historical snapshots
1---2name: ctf-osint3description: Open Source Intelligence techniques for CTF challenges. Use when gathering information from public sources, social media, geolocation, DNS records, username enumeration, reverse image search, Google dorking, Wayback Machine, Tor relays, FEC filings, or identifying unknown data like hashes and coordinates.4license: MIT5---6
7# CTF OSINT
8
9Quick reference for OSINT CTF challenges. Each technique has a one-liner here; see supporting files for full details.
10
11## Additional Resources
12
13- [social-media.md](social-media.md) - Twitter/X (user IDs, Snowflake timestamps, Nitter, memory.lol, Wayback CDX), Tumblr (blog checks, post JSON, avatars), BlueSky search + API, Unicode homoglyph steganography, Discord API, username OSINT (namechk, whatsmyname), platform false positives, multi-platform chains
14- [geolocation-and-media.md](geolocation-and-media.md) - Image analysis, reverse image search, geolocation techniques (railroad signs, infrastructure maps, MGRS), EXIF/metadata, hardware identification, newspaper archives, IP geolocation
15- [web-and-dns.md](web-and-dns.md) - Google dorking, Google Docs/Sheets enumeration, DNS recon (TXT, zone transfers), Wayback Machine, FEC research, Tor relay lookups, GitHub repository analysis, Telegram bot investigation
16
17---
18
19## String Identification
20
21- 40 hex chars -> SHA-1 (Tor fingerprint)
22- 64 hex chars -> SHA-256
23- 32 hex chars -> MD5
24
25## Twitter/X Account Tracking
26
27- Persistent numeric User ID: `https://x.com/i/user/<id>` works even after renames.
28- Snowflake timestamps: `(id >> 22) + 1288834974657` = Unix ms.
29- Wayback CDX, Nitter, memory.lol for historical data. See [social-media.md](social-media.md).
30
31## Tumblr Investigation
32
33- Blog check: `curl -sI` for `x-tumblr-user` header. Avatar at `/avatar/512`. See [social-media.md](social-media.md).
34
35## Username OSINT
36
37- [whatsmyname.app](https://whatsmyname.app) (741+ sites), [namechk.com](https://namechk.com). Watch for platform false positives. See [social-media.md](social-media.md).
38
39## Image Analysis & Reverse Image Search
40
41- Google Images, TinEye, Yandex (faces). Check corners for visual stego. Twitter strips EXIF. See [geolocation-and-media.md](geolocation-and-media.md).
42
43## Geolocation
44
45- Railroad signs, infrastructure maps (OpenRailwayMap, OpenInfraMap), process of elimination. See [geolocation-and-media.md](geolocation-and-media.md).
46
47## MGRS Coordinates
48
49- Grid format "4V FH 246 677" -> online converter -> lat/long -> Google Maps. See [geolocation-and-media.md](geolocation-and-media.md).
50
51## Metadata Extraction
52
53```bash
54exiftool image.jpg # EXIF data
55pdfinfo document.pdf # PDF metadata
56mediainfo video.mp4 # Video metadata
57```
58
59## Google Dorking
60
61```
62site:example.com filetype:pdf
63intitle:"index of" password
64```
65
66See [web-and-dns.md](web-and-dns.md).
67
68## Google Docs/Sheets
69
70- Try `/export?format=csv`, `/pub`, `/gviz/tq?tqx=out:csv`, `/htmlview`. See [web-and-dns.md](web-and-dns.md).
71
72## DNS Reconnaissance
73
74```bash
75dig -t txt subdomain.ctf.domain.com
76dig axfr @ns.domain.com domain.com # Zone transfer
77```
78
79Always check TXT, CNAME, MX for CTF domains. See [web-and-dns.md](web-and-dns.md).
80
81## Tor Relay Lookups
82
83- `https://metrics.torproject.org/rs.html#simple/<FINGERPRINT>` -- check family, sort by "first seen". See [web-and-dns.md](web-and-dns.md).
84
85## GitHub Repository Analysis
86
87- Check issue comments, PR reviews, commit messages, wiki edits via `gh api`. See [web-and-dns.md](web-and-dns.md).
88
89## Telegram Bot Investigation
90
91- Find bot references in browser history, interact via `/start`, answer verification questions. See [web-and-dns.md](web-and-dns.md).
92
93## FEC Political Donation Research
94
95- FEC.gov for committee receipts; 501(c)(4) orgs obscure original funders. See [web-and-dns.md](web-and-dns.md).
96
97## IP Geolocation
98
99```bash
100curl "http://ip-api.com/json/103.150.68.150"
101```
102
103See [geolocation-and-media.md](geolocation-and-media.md).
104
105## Unicode Homoglyph Steganography
106
107**Pattern:** Visually-identical Unicode characters from different blocks (Cyrillic, Greek, Math) encode binary data in social media posts. ASCII = 0, homoglyph = 1. Group bits into bytes for flag. See [social-media.md](social-media.md#unicode-homoglyph-steganography-on-bluesky-metactf-2026).
108
109## BlueSky Public API
110
111No auth needed. Endpoints: `public.api.bsky.app/xrpc/app.bsky.feed.searchPosts?q=...`, `app.bsky.actor.searchActors`, `app.bsky.feed.getAuthorFeed`. Check all replies to official posts. See [social-media.md](social-media.md#unicode-homoglyph-steganography-on-bluesky-metactf-2026).
112
113## Resources
114
115- **Shodan** - Internet-connected devices
116- **Censys** - Certificate and host search
117- **VirusTotal** - File/URL reputation
118- **WHOIS** - Domain registration
119- **Wayback Machine** - Historical snapshots
majiayu000