القائمة
Open Source Intelligence techniques for CTF challenges. Use when gathering information from public sources, social media, geolocation, or identifying unknown data.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
| name | ctf-osint |
| description | Open Source Intelligence techniques for CTF challenges. Use when gathering information from public sources, social media, geolocation, or identifying unknown data. |
| user-invocable | false |
| allowed-tools | ["Bash","Read","Write","Edit","Glob","Grep","Task","WebFetch","WebSearch"] |
https://metrics.torproject.org/rs.html#simple/<FINGERPRINT>
Check family members and sort by "first seen" date for ordered flags.
"username" with quotes on platform-specific searchesPersistent numeric User ID (key technique):
https://x.com/i/user/<numeric_id> — works even after username changes"author":{"identifier":"..."})Username rename detection:
http://web.archive.org/cdx/search/cdx?url=twitter.com/USERNAME*&output=jsonAlternative Twitter data sources:
nitter.poast.org/USERNAME) show tweets without loginhttps://syndication.twitter.com/srv/timeline-profile/screen-name/USERNAME(id >> 22) + 1288834974657 = Unix msWayback Machine for Twitter:
# Find all archived URLs for a username
curl "http://web.archive.org/cdx/search/cdx?url=twitter.com/USERNAME*&output=json&fl=timestamp,original,statuscode"
# Also check profile images
curl "http://web.archive.org/cdx/search/cdx?url=pbs.twimg.com/profile_images/*&output=json"
# Check t.co shortlinks
curl "http://web.archive.org/cdx/search/cdx?url=t.co/SHORTCODE&output=json"
Blog existence check:
curl -sI "https://USERNAME.tumblr.com" → look for x-tumblr-user header (confirms blog exists even if API returns 401)Extracting post content from Tumblr HTML:
"content":[ to find post body datatype: "text" with text field, and type: "image" with media URLshttps://64.media.tumblr.com/HASH/HASH-XX/s512x512u_c1/FILENAME.jpgAvatar as flag container:
https://api.tumblr.com/v2/blog/USERNAME.tumblr.com/avatar/512https://USERNAME.tumblr.com/avatar/512 (redirects to CDN URL)Flags often in TXT records of subdomains, not root domain:
dig -t txt subdomain.ctf.domain.com
dig -t any domain.com
dig axfr @ns.domain.com domain.com # Zone transfer
/export?format=csv - Export as CSV/pub - Published version/gviz/tq?tqx=out:csv - Visualization API CSV export/htmlview - HTML viewPattern (On The Grid): Encoded coordinates like "4V FH 246 677".
Identification: Challenge title mentions "grid", code format matches MGRS pattern.
Conversion: Use online MGRS converter → lat/long → Google Maps for location name.
Pattern (Shell Game): Track organizational donors through FEC filings.
Key resources:
Pattern (Ms Blue Sky): Find target's posts on BlueSky social media.
Search filters:
from:username # Posts from specific user
since:2025-01-01 # Date range
has:images # Posts with images
Reference: https://bsky.social/about/blog/05-31-2024-search
"username" in quotes on major platformsUsername chain tracing (account renames):
Platform false positives (return 200 but no real profile):
t.me/USER): Always returns 200 with "Contact @USER" page; check for "View" vs "Contact" in titlePriority platforms for CTF username enumeration:
exiftool image.jpg # EXIF data
pdfinfo document.pdf # PDF metadata
mediainfo video.mp4 # Video metadata
site:example.com filetype:pdf
intitle:"index of" password
inurl:admin
"confidential" filetype:doc
Pattern: Forensic artifacts (browser history, chat logs) may reference Telegram bots that require active interaction.
Finding bot references in forensics:
# Search browser history for Telegram URLs
import sqlite3
conn = sqlite3.connect("History") # Edge/Chrome history DB
cur = conn.cursor()
cur.execute("SELECT url FROM urls WHERE url LIKE '%t.me/%'")
# Example: https://t.me/comrade404_bot
Bot interaction workflow:
https://t.me/<botname> → Opens in Telegram/start or bot's custom commandVerification question patterns:
Example bot flow:
Bot: "TIER 1: Which account used for online search?"
→ Answer from Edge history showing Bing/Google searches
Bot: "TIER 2: Which account name did you change?"
→ Answer from Security event log (account rename events)
Bot: [Grants access] "Website: http://x.x.x.x:5000, Username: mehacker, Password: flaghere"
Key insight: Bot responses may reveal:
Common flow:
Platform-specific flag locations:
Key techniques:
Free geolocation services:
# IP-API (no key required)
curl "http://ip-api.com/json/103.150.68.150"
# ipinfo.io
curl "https://ipinfo.io/103.150.68.150/json"
Bangladesh IP ranges (common in KCTF):
103.150.x.x - Bangladesh ISPsCorrelating location with evidence:
CIP fieldCryptography techniques for CTF challenges. Use when attacking encryption, hashing, ZKP, signatures, or mathematical crypto problems.
Digital forensics and blockchain analysis for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, or cryptocurrency transactions.
Malware and network analysis techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom protocols, or C2 traffic.
Miscellaneous CTF challenge techniques. Use for trivia, automation scripts, encoding puzzles, RF/SDR signal processing, or challenges that don't fit other categories.
Binary exploitation (pwn) techniques for CTF challenges. Use when exploiting buffer overflows, format strings, heap vulnerabilities, race conditions, or kernel bugs.
Target reconnaissance and enumeration for CTF challenges. Use when you need to scan ports, discover services, enumerate web directories, or fingerprint technology stacks.