Investigate CTF clues through OSINT, research using publicly available information. Use image searches, social profiles, DNS records, and archived pages to identify locations, trace accounts, and connect evidence from multiple public sources.
Provides open source intelligence techniques for CTF challenges. Use when gathering information from public sources, social media, geolocation, DNS records, username enumeration, reverse image search, Google dorking, Wayback Machine, Tor relays, FEC filings, or identifying unknown data like hashes and coordinates.
Review the instructions the agent will receive before you install.
Quick reference for OSINT CTF challenges. Each technique has a one-liner here; see supporting files for full details.
Python packages (all platforms):
pip install shodan Pillow
Linux (apt):
apt install whois dnsutils nmap libimage-exiftool-perl imagemagick curl
macOS (Homebrew):
brew install whois bind nmap exiftool imagemagick curl
MCP servers (optional): Playwright MCP (microsoft/playwright-mcp) for browser-driven OSINT (JS-rendered pages, reverse-image/map flows) — see tools-mcp.md.
browser_network_requests (list) + browser_network_request part="response-body" (payload)/ctf-forensics./ctf-web./ctf-malware.# DNS recon
dig +short -t txt target.com
dig +short -t cname target.com
dig +short -t mx target.com
dig -t txt target.com
dig axfr @ns.target.com target.com
whois target.com
# Image metadata
exiftool image.jpg
identify -verbose image.jpg | head -30
# Web archive
curl "https://web.archive.org/web/20230101*/target.com"
# Username lookup (site is browser-only — no JSON API; curl returns 403)
git clone https://github.com/WebBreacher/WhatsMyName
cd WhatsMyName/scripts/checker && python3 wmn_check.py --help # needs requests + playwright
# Shodan
shodan search "hostname:target.com"
shodan host <ip>
https://x.com/i/user/<id> works even after renames.(id >> 22) + 1288834974657 = Unix ms.curl -sI for x-tumblr-user header. Avatar at /avatar/512. See social-media.md.XXXX+XXX (chars: 23456789CFGHJMPQRVWX). Drop a pin on Google Maps → Plus Code appears in details. Free, no API key needed. See geolocation-and-media.md.exiftool image.jpg # EXIF data
pdfinfo document.pdf # PDF metadata
mediainfo video.mp4 # Video metadata
site:example.com filetype:pdf
intitle:"index of" password
Image TBS filters: Append &tbs=itp:face to Google Image URLs to filter for faces only (strips logos/banners). See web-and-dns.md.
/export?format=csv, /pub, /gviz/tq?tqx=out:csv, /htmlview. See web-and-dns.md.dig -t txt subdomain.ctf.domain.com
dig axfr @ns.domain.com domain.com # Zone transfer
Always check TXT, CNAME, MX for CTF domains. See web-and-dns.md.
https://metrics.torproject.org/rs.html#simple/<FINGERPRINT> -- check family, sort by "first seen". See web-and-dns.md.gh api. See web-and-dns.md./start, answer verification questions. See web-and-dns.md.curl "http://ip-api.com/json/103.150.68.150"
Pattern: Visually-identical Unicode characters from different blocks (Cyrillic, Greek, Math) encode binary data in social media posts. ASCII = 0, homoglyph = 1. Group bits into bytes for flag. See social-media.md.
No auth needed. Endpoints: public.api.bsky.app/xrpc/app.bsky.feed.searchPosts?q=..., app.bsky.actor.searchActors, app.bsky.feed.getAuthorFeed. Check all replies to official posts. See social-media.md.
Pattern: Port appears open on a standard service port (22/SSH, 80/HTTP) but runs a fake service. nmap -sV or nc host port reveals the flag in the banner. Never trust port numbers alone -- always fingerprint the service. See web-and-dns.md.
Search Shodan by SSH host key fingerprint to identify servers: shodan search "fingerprint:AA:BB:CC:...". See web-and-dns.md.
Lookup usernames across gaming platforms (Steam, Xbox, PSN, MMOs) for character profiles, activity, and linked accounts. See social-media.md.
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Investigate AI and machine learning CTF challenges by inspecting model weights, comparing training changes, and exploring adversarial inputs that cause misclassification. Includes references for prompt injection, model reconstruction, and identifying possible training data.
Analyze cryptography challenges in CTF security competitions by matching clues to known weaknesses in encryption, signatures, and random number generators. Use technique summaries and supporting code examples to work toward recovering plaintext or keys.
Analyze CTF evidence such as disk images, memory dumps, logs, and network captures to recover files and trace activity. Includes techniques for finding hidden data in images, audio, and PDFs, plus hardware signal analysis.
Analyze malware in CTF security challenges using techniques for obfuscated scripts, executable files, encrypted traffic, and memory dumps. Follow references to extract configurations, identify command-and-control servers, and find indicators of compromise, such as suspicious domains.
Explore CTF puzzles that span categories or use unusual formats, including layered encodings, restricted Python or Bash environments, QR codes, audio signals, and logic games. Provides technique references for decoding clues and solving constraints.
Develop exploits for CTF binaries with known memory handling weaknesses. Inspect protections, debug failures, and choose techniques for stack, heap, or kernel bugs to turn an identified flaw into code execution or elevated privileges.