S Skillteca
Receber por email
Explorar Categorias Coleções Newsletter
← Voltar para o catálogo

ctf-osint

Pesquisa e Web Autor: ljagiello

Provides open source intelligence techniques for CTF challenges. Use when gathering information from public sources, social media, geolocation, DNS records, username enumeration, reverse image search, Google dorking, Wayback Machine, Tor relays, FEC filings, or identifying unknown data like hashes and coordinates.

2.5kestrelas
Atualizado há 4 meses
Ver no GitHub ↗ Licença: MIT

Como adicionar

/plugin marketplace add ljagiello/ctf-skills

O comando exato pode variar conforme o repositório. Confira o README no GitHub.

Para o autor da skill

Cole no README do seu repo

Mostra que sua skill está catalogada na Skillteca, gera backlink e tráfego rastreável.

[![Skillteca](https://www.skillteca.com.br/api/badge/ctf-osint/svg)](https://www.skillteca.com.br/skills/ctf-osint)

Skills relacionadas

Ver todas de Pesquisa e Web →

understand-domain

64.4k

Extrai conhecimento do domínio de negócio de uma base de código e gera um grafo interativo de fluxo de domínio. Funciona de forma autônoma (varredura leve) ou deriva de um grafo de conhecimento /understand existente.

Pesquisa e Web #ai por Lum1104

understand-dashboard

64.4k 2

Lance o painel web interativo para visualizar o grafo de conhecimento de uma base de código.

Pesquisa e Web por Lum1104

understand-chat

64.4k

Use quando precisar fazer perguntas sobre uma base de código ou entender código usando um grafo de conhecimento.

Pesquisa e Web por Lum1104

dev-browser

63k

Automatiza interações do navegador com estado de página persistente. Utilize para navegar em sites, preencher formulários, tirar capturas de tela, extrair dados da web, testar aplicativos ou automatizar fluxos de trabalho do navegador.

Pesquisa e Web #test por code-yeongyu

Alerta por categoria

Receba novas skills de Pesquisa e Web toda segunda

1 email curto, só com as skills novas de Pesquisa e Web. 4 minutos de leitura, sem spam, cancela com 1 clique.

Você confirma o email no primeiro envio. Sem spam. Cancela com 1 clique.

Ler descrição completa

CTF OSINT

Quick reference for OSINT CTF challenges. Each technique has a one-liner here; see supporting files for full details.

Prerequisites

Python packages (all platforms):

pip install shodan Pillow

Linux (apt):

apt install whois dnsutils nmap libimage-exiftool-perl imagemagick curl

macOS (Homebrew):

brew install whois bind nmap exiftool imagemagick curl

Additional Resources

  • [social-media.md](social-media.md) - Twitter/X (user IDs, Snowflake timestamps, Nitter, memory.lol, Wayback CDX), Tumblr (blog checks, post JSON, avatars), BlueSky search + API, Unicode homoglyph steganography, Discord API, username OSINT (namechk, whatsmyname, Osint Industries), username metadata mining (postal codes), platform false positives, multi-platform chains, Strava fitness route OSINT
  • [geolocation-and-media.md](geolocation-and-media.md) - Image analysis, reverse image search (including Baidu for China), Google Lens cropped region search, reflected/mirrored text reading, geolocation techniques (railroad signs, infrastructure maps, MGRS), Google Plus Codes, EXIF/metadata, hardware identification, newspaper archives, IP geolocation, Google Street View panorama matching, What3Words micro-landmark matching, Google Maps crowd-sourced photo verification, Overpass Turbo spatial queries, music-themed landmark geolocation with key encoding
  • [web-and-dns.md](web-and-dns.md) - Google dorking (including TBS image filters), Google Docs/Sheets enumeration, DNS recon (TXT, zone transfers), Wayback Machine, FEC research, Tor relay lookups, GitHub repository analysis, Telegram bot investigation, WHOIS investigation (reverse WHOIS, historical WHOIS, IP/ASN lookup), fake service banner detection via nmap fingerprinting

When to Pivot

  • If you already have the files or packets locally and now need extraction or carving, switch to /ctf-forensics.
  • If the task becomes active exploitation of a live HTTP service, switch to /ctf-web.
  • If you uncover malware samples, beacons, or suspicious binaries during attribution, switch to /ctf-malware.

Quick Start Commands

# DNS recon
dig -t any target.com
dig -t txt target.com
dig axfr @ns.target.com target.com
whois target.com

# Image metadata
exiftool image.jpg
identify -verbose image.jpg | head -30

# Web archive
curl "https://web.archive.org/web/20230101*/target.com"

# Username lookup
curl -s "https://whatsmyname.app/api/lookup?username=<user>"

# Shodan
shodan search "hostname:target.com"
shodan host <ip>

String Identification

  • 40 hex chars -> SHA-1 (Tor fingerprint)
  • 64 hex chars -> SHA-256
  • 32 hex chars -> MD5

Twitter/X Account Tracking

  • Persistent numeric User ID: https://x.com/i/user/<id> works even after renames.
  • Snowflake timestamps: (id >> 22) + 1288834974657 = Unix ms.
  • Wayback CDX, Nitter, memory.lol for historical data. See [social-media.md](social-media.md).

Tumblr Investigation

  • Blog check: curl -sI for x-tumblr-user header. Avatar at /avatar/512. See [social-media.md](social-media.md).

Username OSINT

Image Analysis & Reverse Image Search

  • Google Lens (crop to region of interest), Google Images, TinEye, Yandex (faces). Check corners for visual stego. Twitter strips EXIF. See [geolocation-and-media.md](geolocation-and-media.md).
  • Cropped region search: Isolate distinctive elements (shop signs, building facades) and search via Google Lens for better results than full-scene search. See [geolocation-and-media.md](geolocation-and-media.md).
  • Reflected text: Flip mirrored/reflected text (water, glass) horizontally; search partial text with quoted strings. See [geolocation-and-media.md](geolocation-and-media.md).

Geolocation

  • Railroad signs, infrastructure maps (OpenRailwayMap, OpenInfraMap), process of elimination. See [geolocation-and-media.md](geolocation-and-media.md).
  • Street View panorama matching: Feature extraction + multi-metric image similarity ranking against candidate panoramas. Useful when challenge image is a crop of a Street View photo. See [geolocation-and-media.md](geolocation-and-media.md).
  • Road sign OCR: Extract text from directional signs (town names, route numbers) to pinpoint road corridors. Driving side + sign style + script identify the country. See [geolocation-and-media.md](geolocation-and-media.md).
  • Architecture + brand identification: Post-Soviet concrete = Russia/CIS; named businesses → search locations/branches → cross-reference with coastline/terrain. See [geolocation-and-media.md](geolocation-and-media.md).
  • Music-themed landmark geolocation: Multiple images of music-related landmarks worldwide; each yields a piano key number encoding one flag character. Identify all locations first, then decode the key sequence. See [geolocation-and-media.md](geolocation-and-media.md).

MGRS Coordinates

  • Grid format "4V FH 246 677" -> online converter -> lat/long -> Google Maps. See [geolocation-and-media.md](geolocation-and-media.md).

Google Plus Codes

  • Format XXXX+XXX (chars: 23456789CFGHJMPQRVWX). Drop a pin on Google Maps → Plus Code appears in details. Free, no API key needed. See [geolocation-and-media.md](geolocation-and-media.md).

Metadata Extraction

exiftool image.jpg           # EXIF data
pdfinfo document.pdf         # PDF metadata
mediainfo video.mp4          # Video metadata

Google Dorking

site:example.com filetype:pdf
intitle:"index of" password

Image TBS filters: Append &tbs=itp:face to Google Image URLs to filter for faces only (strips logos/banners). See [web-and-dns.md](web-and-dns.md).

Google Docs/Sheets

  • Try /export?format=csv, /pub, /gviz/tq?tqx=out:csv, /htmlview. See [web-and-dns.md](web-and-dns.md).

DNS Reconnaissance

dig -t txt subdomain.ctf.domain.com
dig axfr @ns.domain.com domain.com  # Zone transfer

Always check TXT, CNAME, MX for CTF domains. See [web-and-dns.md](web-and-dns.md).

Tor Relay Lookups

  • https://metrics.torproject.org/rs.html#simple/<FINGERPRINT> -- check family, sort by "first seen". See [web-and-dns.md](web-and-dns.md).

GitHub Repository Analysis

  • Check issue comments, PR reviews, commit messages, wiki edits via gh api. See [web-and-dns.md](web-and-dns.md).

Telegram Bot Investigation

  • Find bot references in browser history, interact via /start, answer verification questions. See [web-and-dns.md](web-and-dns.md).

FEC Political Donation Research

  • FEC.gov for committee receipts; 501(c)(4) orgs obscure original funders. See [web-and-dns.md](web-and-dns.md).

IP Geolocation

curl "http://ip-api.com/json/103.150.68.150"

See [geolocation-and-media.md](geolocation-and-media.md).

Unicode Homoglyph Steganography

Pattern: Visually-identical Unicode characters from different blocks (Cyrillic, Greek, Math) encode binary data in social media posts. ASCII = 0, homoglyph = 1. Group bits into bytes for flag. See [social-media.md](social-media.md#unicode-homoglyph-steganography-on-bluesky-metactf-2026).

BlueSky Public API

No auth needed. Endpoints: public.api.bsky.app/xrpc/app.bsky.feed.searchPosts?q=..., app.bsky.actor.searchActors, app.bsky.feed.getAuthorFeed. Check all replies to official posts. See [social-media.md](social-media.md#unicode-homoglyph-steganography-on-bluesky-metactf-2026).

Fake Service Banner Detection

Pattern: Port appears open on a standard service port (22/SSH, 80/HTTP) but runs a fake service. nmap -sV or nc host port reveals the flag in the banner. Never trust port numbers alone -- always fingerprint the service. See [web-and-dns.md](web-and-dns.md#fake-service-banner-detection-via-fingerprinting-metactf-flash-2026).

Shodan SSH Fingerprint Lookup

Search Shodan

Compartilhar X LinkedIn