← All writeups

Operation Broken Shield

June 2026 · OSINT UK CTF · 5 challenges

The Initial Compromise (4pts)

Welcome to NATO Cyber Command. As an open-source intelligence analyst, you are tasked with investigating an active operational security incident. A potential supply-chain vulnerability has been detected, and your team is responsible for piecing together the digital breadcrumbs left across public infrastructure. You must parse raw data, review historical archives, and trace assets across open networks to contain the threat. Good luck.

A civilian contractor cleaning at an allied facility posted an image to a private online forum to complain about their messy workspace.

Around the same time, network administrators noticed a sharp increase in unusual network activity originating near that specific sector.

The image appears to have been redacted before upload, but we suspect it may still contain the root cause of the anomaly.

Task: Analyse the image to determine if any network credentials were leaked. If so, provide the password of the compromised network.

Answer Format:

  • Use the osintuk{answer} format.
  • Case sensitivity is not important.
    e.g. osintuk{P@S5w0Rd}

Taking the image to any image editor and increasing the brightness reveals text hidden behind the redaction. In this case, a wifi password: 2aB8dF.

Flag: osintuk{2aB8dF}

The Exfiltration Vector (6pts)

Following the network breach, security logs indicate the threat actors targeted a ground telemetry system.

We believe they were attempting to intercept data related to an active allied military flight operating over Toulouse on 13/04/2026 at exactly 11:43 local time in France.

Task: To help us determine what mission data may have been exposed, identify the aircraft that was in the airspace at that exact moment. What was its callsign?

Answer Format:

  • Use the osintuk{answer} format.
  • Case sensitivity is not important.
    e.g. osintuk{RANGR93}

We can solve this challenge by going to the ADS-B Exchange, which we can use to look up current and historic flight data. Going to 13th April 2026, 11:43am (French local time), we can see a military plane with the callsign FAF4130 flying directly over Toulouse.

To make life even easier, there’s also a filter on the right-hand side of the website for displaying military aircraft only. This helps reduce the noise in crowded environments.

Flag: osintuk{FAF4130}

Legacy Architecture (5pts)

To understand exactly how the threat actors planned to exploit the ground telemetry system, engineering teams need to analyse the legacy hardware documentation.

The hardware was originally manufactured by Thales-ATM, but the original technical manuals are difficult to locate on the live internet today.

We know a specific validation trial report regarding the “1090 MHz ES Ground station” was previously available on the International Civil Aviation Organization domain (icao.int) sometime during 2005.

Task: Retrieve the historic PDF manual from 2005. What is the exact filename of the PDF document containing these specifications?

Answer Format:

  • Use the osintuk{answer} format.
  • Case sensitivity is not important.
  • Include the dot and pdf extension (.pdf).
    e.g. osintuk{file.pdf}

This is certainly one of the more frustrating challenges on the OSINT UK CTF. The challenge explicitly asks for a ‘technical manual’, which the target document ultimately isn’t. This led to a lot of unnecessary time spent chasing dead ends. I wasn’t able to crack this one without asking the challenge creator for a hint, which I’ll post below. For the sake of transparency, I’ve shown my steps - and wrong turns - below.

I started by Google dorking the target term, ‘1090 MHz ES Ground Station’, against the icao.int domain. This showed a live site and document which makes reference to ADS-B testing at Toulouse airport in 2005.

This initially looked like the target document, but with a wrinkle - this document is still available on the clear web and isn’t archived. I submitted ‘apanpirg16rpt.pdf’ as the flag on the off chance the challenge creator had made a mistake, but unfortunately, this wasn’t correct. The hunt continued.

I took the document as being a necessary hint along the way to finding the target document due to the exact matching text. It mentions ADS-B testing with EUROCONTROL as part of Project CRISTAL. With this found, I started conducting Wayback Machine searches on icao.int and eurocontrol.int to identify any technical manuals posted there from 2005. Beyond manual searches on both websites, I tried using Wayback Machine’s ‘Site URL’ function to filter for PDF documents hosted on the website. This was done by searching ‘application/pdf’ and ‘.pdf’ respectively.

Searches against archived websites of note - for Eurocontrol, ICAO and Thales, the ground station’s part-manufacturer - identified a lot of useful background information for those interested in the development of ADSB and a host of relevant PDFs, but none resolved the flag. It looked like I wasn’t alone - at the time of writing, only two other individuals not at the NATO summit appeared to have solved this puzzle.

After a few days of banging my head against a wall, I reached out to Joshua Richards to ask for a hint as to where I was going wrong. In the interests of transparency, he reached back with more information than expected. Thank you Josh!

With this, I went back to the Wayback Machine and ran a quoted search for ‘1090 MHz ES Ground station’. This surfaced one document with ‘2005’ listed in the URL title. The document name is ‘ip07.pdf’, a meeting regarding ADS-B validation trials in Toulouse, which resolves the flag.

Flag: osintuk{ip07.pdf}

The Unannounced Support (6pts)

Our sensor arrays have detected an active sensor sweep originating from an aircraft operating in the vicinity of the telemetry breach.

Operational command has been slow to update us, and we have received conflicting reports regarding whether this flight was authorised to provide support.

The aircraft is broadcasting an ICAO 24-bit address of 40665B, but our local logs are missing the flight plan and formal assignment details.

Task: Investigate the aircraft associated with this ICAO address and provide the full postcode listed in the registration details of the aircraft owner.

Answer Format:

  • Use the osintuk{answer} format.
  • Case sensitivity is not important.
  • Remove any spaces.
    e.g. osintuk{SW1A1AA}

Quick googling into ICAO 24-bit addresses revealed that they’re allocated in blocks, with certain number ranges defining countries. I asked Claude to identify what nationality 40665B represented, which gave the United Kingdom. For the aviation enthusiasts amongst you, more comprehensive information is available on Kloth.

Now we know the plane is British-registered, we can start to look for national registries. In the UK, the UKCAA (UK Civil Aviation Authority) is the exact one we need - it allows for information lookups based on ICAO hexes.

By going into ‘Advanced Search’, we can run the ICAO search. Searching the hex gives us the registered owner: ‘THALES UK LTD’. It includes the postcode of RH10 9HA. This resolves the flag.

Flag: osintuk{RH109HA}

Ground Intercept (9pts)

Verification of the unannounced Thales flight confirms it was a friendly asset performing an automated sensor sweep.

While you were verifying the tracking platform, human intelligence (HUMINT) sources intercepted an operational image transmitted by the threat actor.

Our analysis team initially had very little to go on regarding the image itself, but the friendly aircraft’s onboard array has now alerted us that it detected rogue signal transmissions originating specifically from the southern sector of the Tarn department in France.

We need you to determine where this photograph was taken so ground units can be deployed to secure the physical node.

Task: Analyse the attached image and pinpoint the location of the bus stop shown in the picture and provide the 5-digit postal code of the area.

Answer Format:

  • Use the osintuk{answer} format.
  • Case sensitivity is not important.
    e.g. osintuk{12345}

This is the sort of challenge that looks scary on the face of things, but - once you know the trick - it’s not as hard to solve as it seems.

I started by looking at what’s available in the photograph and noting key landmarks within it. The two that stood out most to me are the church and the bus stop.

One of my favourite tools is Overpass Turbo, which allows for searches against nodes saved on OpenStreetMap.

An adjacent program/website, FindThatSpot, builds on OT by allowing searches based on natural language input. It’s possible to log in with Github, and I thoroughly recommend it.

To evidence Find That Spot’s strength, here’s the query that I ran, alongside the results generated:

Clicking on the purple icons offers a detachable Street View option, displaying a view of the area without needing to leave the website. Clicking around shows a match for Église Saint-Louis church.

By clicking into ‘Google’ and selecting any location within the town, we get the postcode: 81090. This resolves the flag and completes the challenge.

Flag: osintuk{81090}