← All writeups

Operation Constellation

May 2026 · OSINT UK CTF · 7 challenges

Developed in Darkness (3pts)

‘The Constellation Killer’ has sent a ripple of fear through law enforcement worldwide. For months, authorities have been on edge, trying to make sense of the brutal killings that have stretched across continents. His signature? A series of clues sent to the police, each hinting towards the location of his kills.

In his most recent spree, the killer claimed seven victims, but the pattern was maddeningly elusive. Each crime scene seemed random, scattered across different cities. Investigators speculated he was working from a list, but no one could determine the logic behind his choices. Some believed the locations were connected to astrological events. Others thought there was a deeper meaning hidden in his clues, but despite all efforts, no one had cracked the code.

Now, it seems the killer has resurfaced once again and is restarting his ritual. A polaroid picture was mailed to the police headquarters in London. As lead detective on the case, you need to track down this killer and stop him once and for all.

What is the name of the square in the polaroid?

Answer Format:

  • Use the osintuk{answer} format.
  • Replace any spaces with an underscore.
    e.g. osintuk{George_Square}

The first thing I noticed on this image was the text - ‘Merak’ - which I make a note of for later.

After that, I made a note of the clock tower as being the defining feature of the square. I then ran the image through Google Lens to try and find a match. This led to very quick identification of Albert Square in Manchester.

Flag: osintuk{Albert_Square}

A Walk in the Park (5pts)

The Constellation Killer’s reign of terror continues, and his messages grow increasingly sinister. After successfully identifying Albert Square in Manchester from the polaroid, the killer’s mocking game has only escalated. Law enforcement feels the pressure mounting, each clue bringing them closer to the edge of desperation. But the killer remains elusive, his twisted puzzle almost impossible to crack.

A new clue has just arrived at the station, and this time it is a USB stick. The drive only contains a single image, everything else has been scrubbed clean.

Locate the park where the image was taken from.

Answer Format:

  • Use the osintuk{answer} format.
  • Replace any spaces with an underscore.
    e.g. osintuk{Killers_Park}

While there are landmarks visible in this image, they’re quite far away, and identifying them seems unusually harsh for the second challenge in a CTF series. As a result, I instead hop over to ExifTools to check for coordinates embedded in the metadata.

Bingo. Straight to Everton Park, Liverpool.

Flag: osintuk{Everton_Park}

The Last Meal (5pts)

The Constellation Killer’s game has become more elaborate with every move. After discovering the Liverpool location in the cryptic clue, the killer’s taunting continues. With each photograph, the clues grow darker, more cryptic, as though the killer is challenging you to keep up with his twisted path. Another polaroid has now arrived at the station, this time it shows a common looking restaurant sign. We have no way of knowing if the image is not doctored, it could be altered. Let’s hope there isn’t another victim here.

Locate the postcode of the fast food restaurant captured in the polaroid.

Answer Format:

  • Use the osintuk{answer} format.
  • No spaces, no punctuation.
    e.g. osintuk{AB19CD}

‘Megrez’? What is this? Clearly a pattern’s forming here. I make a note of that and keep it to one side while I focus on the challenge.

Okay - we have a BigJohn’s located 8 miles from Wolverhampton and just 4 miles from Dudley. Simple enough for a basic Google Maps query. The Google Maps listing has the postcode: B70 9RL.

Flag: osintuk{B709RL}

Remote Access (5pts)

A USB with a single photograph on it was sent to investigators with no accompanying message. The image shows a rural road junction, with minimal signage and little to immediately identify its location.

In the background, a large industrial structure dominates the skyline. While the roads themselves offer few clues, this feature is far less common and may be the key to understanding where the photo was taken.

The killer has relied on observers recognising what others would ignore.

What is the name of the island the image was taken on?

Answer Format:

  • Use the osintuk{answer} format.
  • Replace any spaces with underscores.
    e.g. osintuk{Lost_Island}

Google Lens strikes again here. The power station and signage give a very strong indication as to where this may be, and modern AI takes out the inconvenient legwork of cataloguing UK power stations in the area.

A quick Google Street View check confirms this as being Toyota Island roundabout.

Flag: osintuk{Toyota_Island}

Ghost Writer (5pts)

Note: No paid membership or subscriptions are needed for this challenge

Investigators intercepted a newspaper article believed to have been deliberately altered by the Constellation Killer. Key information, most likely the location name, has been carefully removed.

Despite this, the article itself is genuine. Its language, layout, and context were left intact, suggesting the missing location can still be identified through indirect details. Also, strangely enough, the killer wrote on the back of the strip “Halloween 1931”, almost taunting us.

The killer has done this before: removing the obvious and leaving just enough to reward careful research.

Your task is to determine which town or location the article originally refers to.

What location has been redacted from the article?

Answer Format:

  • Use the osintuk{answer} format.
  • Replace any spaces or punctuation with underscores.
    e.g. osintuk{Stratford_upon_Avon}

This one’s rather trivial. By running a double-quoted search with text from either side of the redaction, we’re able to find the flag as the sole Google search result.

What’s less trivial to my eyes is the challenge-within-a-challenge: ‘Halloween 1931’. My spidey senses start to tingle here - between two weird words and this cryptic piece of information, I suspect a later challenge is going to need some secret word or similar from each of the preceding challenges. I wrote that clue alongside the previously-found ‘Merak’ and ‘Megrez’ and carried on.

Flag: osintuk{Moreton_in_Marsh}

Character Witness (8pts)

Investigators have recovered a handwritten note from the last crime scene. The message appears meaningless at first glance, strings of repeated characters with no obvious structure.

Analysts believe the note is intentionally encrypted and that the method used is simple, but not immediately visible. Based on prior trends, once decoded, the message should point toward a specific location.

It is possible the killer has hinted towards the key in prior clues and we haven’t been observant enough.

What location does the message reveal?

Answer Format:

  • Use the osintuk{answer} format.
    e.g. osintuk{Cardiff}

NOTE: Cipher also requires an “alphabet” to decode, the default alphabets seem to be different for people, so we’ll reveal the alphabet needed for this challenge is “abcdefghiklmnopqrstuvwxyz” (without the letter J).

The code appears in hexadecimal again, but the inclusion of the alphabet as a requirement beyond just a key makes this unlikely to be a Vignere cypher. I went to Cryptii to look at what options this could be and found the Nihilist cipher, a polybius square cipher, which fit the bill.

I then thanked the Gods that we live in the era of AI, and asked Claude to OCR and transcribe the numbers from the paper sheet.

Thank you Claude.

The resulting ciphertext is expandable below if you’d like to see it.

64 78 97 45 87 76 39 68 53 76 75 67 70 54 65 56 46 78 25 84 86 46 97 45 87 65 38 99 34 53 76 59 89 63 56 47 66 98 55 65 47 55 70 22 86 55 39 97 45 63 64 78 67 45 76 76 67 107 34 57 74 39 97 22 66 65 75 66 44 66 75 47 70 54 53 63 56 89 54 86 43 67 98 45 76 65 35 98 35 86 53 35 86 42 85 53 66 66 33 74 47 57 99 54 76 53 58 86 25 85 76 58 88 26 86 77 66 88 56 77 84 47 70 53 57 65 58 96 56 53 74 66 109 54 65 66 69 86 25 65 43 75 70 23 57 47 57 86 26 63 76 47 66 42 63 44 69 97 35 57 46 48 88 32 66 47 55 69 54 77 74 39 98 54 57 46 48 88 55 76 84 35 86 42 85 55 35 88 25 73 47 38 66 44 56 74 39 100 54 57 46 67 89 45 63 76 39 88 55 65 47 78 106 26 73 66 67 99 22 75 86 67 78 22 84 67 57 70 54 85 76 47 70 65 76 65 37 70 34 53 46 68 78 26 73 43 57 69 26 53 75 39 98 25 76 84 57 107 22 84 46 48 88 42 76 65 46 89 46 57 65 67 107 26 57 67 67 89 32 55 74 58 90 46 57 46 46 97 22 85 75 46 66 55 65 47 66 79 44 64 56 68 98 26 73 53 35 97 45 87 65 38 66 43 76 46 39 98 55 86 66 76 88 54 57 76 68 86 26 56 84 48 69 26 53 65 38 86 45 94 43 66 70 54 86 74 35 79 44 57 46 66 79 62 57 74 68 78 53 57 43 38 98 54 86 74 35 79 33 65 76 68 78 53 76 77 46 78 35 86 75 47 70 22 84 76 37 86 26 53 74 35 88 25 87 65 47 100 53 84 56 39 69 44 57 83 39 97 25 57 47 59 70 44 76 77 46 78 55 76 45 58 87 43 53 65 38 99 34 57 83 35 86 42 57 86 78 70 55 76 63 38 70 44 76 77 46 78 55 76 55 35 106 26 85 55 35 90 26 56 56 68 88 45 85 56 46 88 46 76 75 68 79 54 75 47 39 69 26 56 55 39 97 26 86 55 39 68 42 87 47 48 98 44 76 76 76 78 22 86 84 35 98 23 87 56 55 99 23 87 76 76 78 22 86 76 47 70 33 84 66 69 88 25 66 65 67 79 54 86 47 38 89 44 76 53 45 70 53 66 65 46 66 44 56 84 47 66 55 64 47 57 70 53 53 76 48 89 44 85 73 69 79 26 86 63 78 86 26 53 74 57 70 25 86 66 76 89 53 67 84 48 99 34

Now it’s just a matter of the key. I mentioned earlier that I had found two hidden words - ‘Megrez’ and ‘Merak’ - within challenges. Google checks identified these as stars in the Big Dipper, whose stars can be found below.

I tried using ‘bigdipper’ as the key, but to no avail. With this being the sixth challenge, I tried the sixth star - Mizar. This hit home and decrypted the text.

I turn to AI to add spaces between the words, which gives us the following passage:

‘My route crosses high dry ground that powders the leather of my boots where rain vanishes almost as soon as it falls fragments of old stone turn up where no quarry should have been left half buried in fields pressed into walls handled and reused so often they’ve lost any sharpness they once had the land eases downward in long open sweeps of cropped grass gathering itself around a modest town settled wide and low a restrained river threads straight through its heart clear and unhurried never deep enough to command the valley yet old enough to have shaped it no signpost is needed here the clue is not what was built but what the ground insisted on offering and what generations quietly learned to work with’

I think I can see where this is going.

Beyond being ciphertext, the locations of previous flags combined appear to broadly mirror the Big DIpper constellation’s appearance itself. I go to Google Earth Pro and plug in the locations to check, and sure enough, it matches the layout. The question then becomes, ‘where’s the next point?’.

Based on the description - old stone, half buried in fields where stone shouldn’t be - I started looking for stone circles within South West England. Wikipedia has a page on this (because of course it does). The next proportional star location appears likely to be in Wiltshire, within which two henges exist.

This pointed me in the direction of Avebury. While tempted to put that in as the answer, the rest of the clue - a modest town - made it seem like a larger area would be the correct flag. Google’s listing for Avebury names it as part of Marlborough. I attempted this, and got the flag.

This was tough, and a lot of hard detective work was required.

Flag: osintuk{Marlborough}

The Big Picture (15pts)

This is the endgame.

A final image has arrived stripped of clear clues and seemingly impossible to place on its own. Investigators believe it was designed this way. The killer expects his pattern to be understood now. Perhaps the previous locations were not random. Together, they could possibly form a deliberate sequence. Only by recognising that structure can the final location be identified.

This is no longer about finding clues, it’s about predicting the killer’s next move.

What is the name of the street the Constellation Killer will strike on next?

Answer Format:

  • Use the osintuk{answer} format.
  • Replace any spaces with underscores.
    e.g. osintuk{Murder_Street}

Following our Marlborough flag, our big dipper is nearly complete.

I tried reverse image searching the location, but without any luck. The image quality is also frustratingly low, but I see this as a hint; if the quality is low, then presumably the elements in the photo are all I need. I immediately hone in on the one unique object in this - a postbox.

I love Overpass Turbo. It’s an incredible tool. My next step was to get Claude to write a script for it to identify all postboxes in the Portsmouth area, which would roughly map to where the next constellation spot should proportionally be.

The script was successful. Unfortunately, it was too successful.

I needed a way to narrow this down. The broader image shows a few extra landmarks of note - a rubbish bin, a street corner, and what looks to be an electricity cabinet on the street.

Given the proximity to the turning, I started simply zooming on the map to see if any fit the description of being within 15 metres of a right-hand turn. While useful, it doesn’t give me any meaningful way to narrow down the barrage of results.

It’s clear I’m stuck. I decided to turn to Google for help to find the latest tips and tricks for map geolocation - maybe I’m missing something. Through this, I discover Spot, an AI-based, NLP tool for identifying places on maps. I sign in and give it a go.

It’s love at first sight with this tool. Searching a natural-language query on it brings up OSM entities that match your query. In this case, it brings up two contenders.

An excellent feature it the ability to open queried features in Google Street View without leaving the webpage. This allowed for quick verification of the correct location, securing the final flag.

Flag: osintuk{Selsmore_Road}