[★★★] Suspect tracking

Identification

the image above.

Solution

i performed some seaches and It seems the photo.jpg is from Best_Western_Premier_Malta-St_Paul_s_Bay_Island_of_Malta

Identified the hotel in the image and found it on Google after doing some image reverse search - Best Western Premium Hotel Malta  One of the reviews on that page ^ was made by a nigga by the alias cybergameosintplayer - which is linked from tripadvisor and it says:

I recently stayed at this hotel and had a pleasant overall experience. The check-in process was smooth and the staff were friendly and helpful throughout my stay BLAH BLAH BLAH. …

On TripAdvisor Click on the user Jolaus profile - profile and see in his intro the first flag

SK-CERT{h0t31_r3vi3w_f14g}

Localization

Solution

Identify the image - and the image is as you see

• within 5 digits of latitude/longitude

The Hotel is at “Triq It-Tamar, St. Paul’s Bay, Island of Malta SPB 1281 Malta”

It is quickly clear this is “Fungus Rock, Malta” that we are seeing. Problem is finding the exact location with precision of 5 decimal digits of lat/lng.

I spent some time finding all possible images of Fungus rock that had GPS coordinates to them. I created a project in Google Earth and marked them all there with pins. Then comparing all of them (their angle, distance, etc.) to the challenge image, I was able to narrow down an area I believed was where the image was taken.

After a couple of tries , I came up with these coordinates:

36.04860,14.19110

Golden hour

Solution

So, we know the location of the image now, we see how high the sun is above the horizon. I figured the best would be to use one of many libraries that can calculate sunset time and sun azimuth at a specific time.

I used SunCalc to determine the approximate azimuth of the sun in the image—just by moving the sun around until the azimuth line roughly matched with the peninsula—compared to the image. By doing that I figured the azimuth of the sun at the time in the image must be around 246° approximately.

Then I wrote [golden_hour.py 

from datetime import date, timedelta, time, datetime

import pytz
from astral import LocationInfo
from astral.sun import sun, azimuth as sun_azimuth

loc = LocationInfo(timezone="CET", latitude=36.04860, longitude=14.19110)

print(loc.timezone)

d = date(2025, 1, 1)
while d.year == 2025:
    s = sun(loc.observer, date=d, tzinfo=pytz.timezone(loc.timezone))['sunset']
    # if s.hour == 17 and s.minute == 14:
    #     print(d)
    if s.hour == 17:
        date_time = pytz.timezone(loc.timezone).localize(datetime.combine(d, time(17, 14)))
        azimuth = sun_azimuth(loc.observer, date_time)
        print(f'date {d} - sunset at {s.hour}:{s.minute}, azimuth at 17:14 is {azimuth:.3f}')
    d += timedelta(days=1)

to calculate the sunset times + azimuth of the sun at 17:14—the time on the picture. I then split it up by what I thought was close enough to my estimate:

there are probably too early, sunset the pic is at least 4-5 minutes away
date 2025-01-17 - sunset at 17:14, azimuth at 17:14 is 244.798
date 2025-01-18 - sunset at 17:15, azimuth at 17:14 is 244.912
date 2025-01-19 - sunset at 17:16, azimuth at 17:14 is 245.032
date 2025-01-20 - sunset at 17:17, azimuth at 17:14 is 245.159

somewhere here?
date 2025-01-21 - sunset at 17:18, azimuth at 17:14 is 245.293
date 2025-01-22 - sunset at 17:19, azimuth at 17:14 is 245.433
date 2025-01-23 - sunset at 17:20, azimuth at 17:14 is 245.580
date 2025-01-24 - sunset at 17:21, azimuth at 17:14 is 245.733
date 2025-01-25 - sunset at 17:22, azimuth at 17:14 is 245.892
date 2025-01-26 - sunset at 17:23, azimuth at 17:14 is 246.058
date 2025-01-27 - sunset at 17:24, azimuth at 17:14 is 246.230
date 2025-01-28 - sunset at 17:25, azimuth at 17:14 is 246.408
date 2025-01-29 - sunset at 17:26, azimuth at 17:14 is 246.592
date 2025-01-30 - sunset at 17:27, azimuth at 17:14 is 246.783
date 2025-01-31 - sunset at 17:28, azimuth at 17:14 is 246.980
date 2025-02-01 - sunset at 17:29, azimuth at 17:14 is 247.182

these are probably too late (past sunset) or azimuth too high
date 2025-02-02 - sunset at 17:31, azimuth at 17:14 is 247.391
date 2025-02-03 - sunset at 17:32, azimuth at 17:14 is 247.605
date 2025-02-04 - sunset at 17:33, azimuth at 17:14 is 247.825
date 2025-02-05 - sunset at 17:34, azimuth at 17:14 is 248.050
date 2025-02-06 - sunset at 17:35, azimuth at 17:14 is 248.282
date 2025-02-07 - sunset at 17:36, azimuth at 17:14 is 248.519
date 2025-02-08 - sunset at 17:37, azimuth at 17:14 is 248.761
date 2025-02-09 - sunset at 17:38, azimuth at 17:14 is 249.008
date 2025-02-10 - sunset at 17:39, azimuth at 17:14 is 249.261

also tried the suncalc to compare and it came cool and perfect. After a few tries I came up with the answer -

0130.

OSINT CHALLENGE 2

[★☆☆] The digital trail

The tip

Solution i goggled dorked and found the exact repository corresponding to the link we were given in the challenge as : DATASHIELD-WEB

At the bottom of the  README.md theres this : U0stQ0VSVHtoMWRkM25fMW5fcGw0MW5fczFnaHR9

 echo U0stQ0VSVHtoMWRkM25fMW5fcGw0MW5fczFnaHR9 | base64 -d
SK-CERT{h1dd3n_1n_pl41n_s1ght}

The evidence

Solution

In the commit here, on this file docs/static/js/analytics-enhanced.js, on line 144 we found the flag as a comment.

SK-CERT{m4l1c10us_c0mm1t_d3t3ct3d}

The digital footprint

Solution

After a cool google dorking i Found posts from evanmassey1976 on reddit.com, the post with the flag is: THE POST

The flag is hidden on the first line of each sentense so Take the first letter of each line then boom the flag.

SK-CERT{S0C14L-M3D14-0S1NT-TR41L}

The private channel

Solution

The user evanmassey1976 on reddit.com included a discord invite, in the #random channel some bots are talking and mention this:

Aleah Franco Note to self: Password for Mark’s channel is ‘ReallySecretNobodyKnowsAboutThisPassword’. Need to keep this safe. SK-CERT{d1sc0rd_b0t_s3cr3ts}

SK-CERT{d1sc0rd_b0t_s3cr3ts}

That is the third flag.

The escape plan

Solution

• To join the secret channel one has to DM Mark Wesley and send the password asReallySecretNobodyKnowsAboutThisPassword
• You are then added to the #hacking channel. There is an image
  
• posted of a forum where all the operations are being migrated to.
• In the descriptive text of that image, still in Discord you will find the text  freirehf-fancr.rh.
• This is ROT13 of the domain serverus-snape.eu.

This domain has a TXT record with a weird looking base64:

host -t ANY serverus-snape.eu
...
serverus-snape.eu descriptive text "U0stQ0VSVHtkbnNfcjNjMHJkXzFuc3AzY3Qwcn0="
...

Decoding that leads to the final flag of this challenge:

SK-CERT{dns_r3c0rd_1nsp3ct0r}

Thats it on osint challenges,