0xFun CTF | OSINT Challenges Writeup

Yoo! It's Ahmed (aka Pizza Steve) back with a writeup for some of the OSINT challenges I solved. I want to show gratitude to both the challenges authors and my teammates, without whom we wouldn't have secured #91 out of 2365 teams!

Sands of Time - Hard

The City of Baths whispers in integers. Within it lies an eatery where numbers are not decoration, but identity.

Once identified, reverse the arrow of time to uncover a nearby neighbour; a name borrowed from a dynasty older than calendars, rooted in the age of the pharaohs.

Remember, Proximity matters more than relevance.

The answer is not hidden behind clicks or forms, but in how the past presents itself online.
The URL itself is the answer, without the garbage in the front.

Keywords:

City of Baths

Within it lies an eatery where numbers are not decoration, but identity

Reverse the arrow of time to uncover a nearby neighbor; a name borrowed from a dynasty older than calendars, rooted in the age of the pharaohs

The answer is not hidden behind clicks or forms, but in how the past presents itself online. The URL itself is the answer

Doing a quick search, we find that "City of Baths" refers to Budapest, Hungary, famous for its extensive historic thermal spring culture.

Now we need to search for a restaurant with numbers in its name, where those numbers actually have meaning.

We could do this the hard way by checking all restaurants in Budapest with numbers in their names and verifying their meaning, or the easy way by optimizing AI Overview feature to our favor.

This simple search saved us a lot of time. Now we need to validate this candidate by looking around it for "a nearby neighbor; a name borrowed from a dynasty older than calendars, rooted in the age of the pharaohs".

I initially got stuck here. I could not find anything related to pharaohs except Anubis Travel, which turned out to be incorrect.

However, Mamdouh Mahfouz, with an eagle's eye, found our target: an exhibition called Tutankhamun. He also found its website, which was the flag.

0xfun{termalfurdo.hu}

GeoSkill - Hard

All i can say is that I hope you enjoy geoOSINT.

This was a multistage geoOSINT challenge. We were given 7 locations and an instance to submit answers to progress through each stage. In this one, I collaborated with Bahy Mohamed to tackle it down.

Stage 1 - Easy

$ nc chall.0xfun.org 61041
========= PLEASE DO NOT BRUTEFORCE THIS CHALLENGE ========

Welcome to my Geoguessr Challenge!
This is a 7-part challenge where the goal is to guess the country/location of each picture taken.

I made this challenge because I enjoy geoOSINT. I do not like plotlines, account OSINT,
or anything that strings different ideas together to find the location. Think of this as
a raw test of geography skill: no hints, no gimmicks, just the image.

For some locations, I based certain photo details off of the hit game Geoguessr.
Looking up data/resources related to the game will be a big help for some of these.

And DO NOT BRUTEFORCE THE REMOTE!
I will find you.

Question 1:
Location 1
Difficulty: Easy

Name the country this statue/location is in.

Format:
- Title Case (Capitalize Every Word)
- Replace spaces with _
Example: United States of America -> United_States_Of_America

This was a piece of cake. We could immediately tell it was Brazil from the Christ the Redeemer statue.

Stage 2 - Easy

Question 2:
Location 2
Difficulty: Easy

Identify the city where this photo was taken.

Again, straightforward. When identifying a location from an image (GeoGuesser), you should use any visible clues to reduce the search area.

We noticed the bank name on the yellow building: Olive Microfinance Bank Limited. Searching for it shows that it is a Nigerian bank in Lagos.

Stage 3 - Easy

Question 3:
Location 3
Difficulty: Easy

Name the island this photo is located on.

Reverse image search leads directly to Christmas Island. Following the required format, the answer is: Christmas_Island

Stage 4 - Medium

Question 4:
Location 4
Difficulty: Medium

Identify the Japanese prefecture this photo is located in.
Hint: You do not need the text in the image to solve this, nor the exact location.

Reverse image search gave two possible results: National Route 194 in Saijō and Kōchi, or Kanpuzan Tunnel in Ehime.

Using trial and error, Ehime was correct.

Stage 5 - Hard

Question 5:
Location 5
Difficulty: Medium

Name the street this photo is located on. The answer is one word as listed on Google Maps.

This one was a bit tough, reversing this will get us nowhere. Here, the GeoGuessr knowledge will come in hand. In fact, it's the key to solve this stage. As we can see, The Google Street View car visible in the image is known as a car meta.

Car meta refers to identifying a location based on the specific features of the Google Street View car - such as its color, snorkel, antennas, or camera setup - rather than landscape or signs.

Using this website, we identified Denmark. Not only that, but also the embedded location is actually the street we are looking for!

Stage 6 - Hard

Question 6:
Location 6
Difficulty: Hard

Find the exact what3words for this spot.
You can find the what3words for an exact coordinate at https://what3words.com
Format:
- Three words separated with periods, no leading ///
Example: muggles.pursues.dispose

The original photo was first fed to Nano Banana Pro, then ChatGPT 5.2 Thinking
with the same prompt: "Recreate this image in AI, but cartoony style"

#isthistheGRANDfinale?

Imo, this was the toughest stage as the original photo was processed twice by AI, exaggerating and simplifying visual details.

By observation, it looked like the Grand Canyon along the Colorado River, and the hint "#isthistheGRANDfinale?" supported this assumption.

We kept going back and forth across all pictures linked to this location and checking every checkpoint along the Colorado River, but with no luck...

This was until Titoot stepped in and managed to identify the original picture we were after.

We were asked to get the exact what3words for this spot, which was another challenge as every square has its unique words. However, admins provided the exact ones after opening a ticket and providing the correct location: sailor.cascading.mower

Stage 7 - Hard

Question 7:
Location 7
Difficulty: Hard

Final stretch. Identify the street this photo is located on.
The answer is the Google Maps name, but in the format below. It is 3 words.

This one felt like a breeze. Not because we are off the shore 😆, but looking carefully we find the clue that solves this stage: the gas station name!

We can first try to reverse search the pic to get the country, narrowing our search scope. Doing so, we know it's Bermuda, but where exactly? The gas station answers this.

I started searching for gas stations starting with "RU" in Bermuda and compared the logo, identifying it's RUBIS.

Again, narrowing down the search scope, we know it's by a road along the ocean, so we only check stations along it.

Final Flag:

0xfun{0m6_br0_m16h7_b3_r41nb0l7}

Regional Pivot - Medium

The author goes by ANormalStick. Your mission is to OSINT the handle, identify the real person behind it, and then locate the flag on a local social media platform connected to their home region.

This isn't a mainstream global platform, and you'll likely need to use the platform's internal search (not just Google) once you've identified the author.

Keywords:

identify the real person behind it

then locate the flag on a local social media platform connected to their home region.

This isn't a mainstream global platform, and you'll likely need to use the platform's internal search (not just Google)

This challenge is about OSINTing the author. Normally, we start by Sherlocking the handle. However, this time we can take a shortcut by visiting his blog, where all his info is present lol.

Checking LinkedIn gave us his real name: Jānis Mārtiņš Īvāns, fromLatvia.

Next, we searched for Latvian social media platforms and found Draugiem.lv.

Many got stuck creating an account to access the site, including me. So I decided to explore the site a bit and see what I could access without logging in. I found out that all profiles must be created with real names to avoid ban, so we won't deal with fake accounts.

I then tried using Google Dorking to bypass the login mechanism since the in-site search feature required it.

site:frype.com Jānis Mārtiņš īvāns

It worked and we found his profile.

After going through his posts, we found the flag:

0xfun{L3t5_M4k3_S0mE_Fr13nd5}