← All writeups

Operation Auto

May 2026 · OSINT UK CTF · 3 challenges

Plates (5pts)

Task: Using the license plate number below, identify photos of the vehicle uploaded online. In the background of a photo of this vehicle, another license plate is also visible, you must provide that other license plate.

License plate: NK H 600

Answer Format:

  • Use the osintuk{answer} format.
  • Remove any spaces.
    e.g. osintuk{ABCD100}

Operation Costa introduced me to PlatesMania - a website for searching for number plates to find vehicle photos taken by enthusiasts. This seemed like the best place to start with this challenge.

Sure enough, searching on the website produces results: a German Ford Mustang. The second image has a visible number plate in the background.

The second plate is legible after opening the image. No further image manipulation is required to get the first flag: GER K 436.

Flag: osintuk{GERK436}

Origin Story (3pts)

Task: Building on your discovery from the previous challenge, determine the specific German district where the background vehicle is officially registered.

Answer Format:

  • Use the osintuk{answer} format.
    e.g. osintuk{Fürstenfeldbruck}

I’m aware of the German numberplate registration format prior to this challenge. The prefix text indicates the region where the vehicle was registered. This is called the ‘Unterscheidungszeichen’, or ‘distinguishing code’.

As is fast becoming my favourite phrase, ‘there’s a Wikipedia page for that’. The corresponding Wiki page contains a complete list of all necessary codes. It shows ‘GER’ as correlating to ‘Germersheim’ in Rhineland-Palatinate.

Flag: osintuk{Germersheim}

Mania ID (2pts)

Task: Identify the numeric ID of the PlatesMania user who uploaded the original images of the initial vehicle.

Answer Format:

  • Use the osintuk{answer} format.
    e.g. osintuk{123456}

Going back to the PlatesMania listing shows it as being uploaded by BRcriskDE. Clicking on his profile reveals his user ID in the URL.

Flag: osintuk{96622}

Germersheim Domain (3pts)

Task: Identify a domain name with “Germersheim” contained in it, that was registered on the 13th December 2024.

Answer Format:

  • Use the osintuk{answer} format.
  • Enter the domain name only.
    e.g. osintuk{example-domain.com}

This is a job for Whoxy, which allows for domain searches based on keyword search.

Go to the website and select ‘domain keyword’ from the drop-down box on the right. Querying ‘Germersheim’ will bring all relevant domains and their registration dates. Searching for the target date reveals the target domain.

Flag: osintuk{germersheim-cruises-all-inclusive-packages.today}