← All writeups

Operation Cord

May 2026 · OSINT UK CTF · 3 challenges

The Boss (3pts)

Task: Find the numeric Discord ID of UK OSINT Community co-founder Nathaniel.

Answer Format:

  • Use the osintuk{answer} format.
  • Numbers only.
    e.g. osintuk{1234657890}

This was an amusing start. I searched for the name ‘Nathaniel’ in the OSINT UK Discord and found ‘Not Nathaniel’. A quick look at their profile shows them to be an ‘OSINT UK Team’ member, meaning we’ve found our target.

Now that we have his username, we need to get his discord ID. We can do this by going to a server that he’s on and running the command ‘\@notnathaniel_98927’ inside any valid chat. That immediately posts the numerical ID.

osintuk{1191511485365616671}

The Birth (4pts)

Task: Identify the UNIX timestamp of when Nathaniel created his Discord account.

Answer Format:

  • Use the osintuk{answer} format. - Numbers only.
    e.g. osintuk{1234657890}

I wasn’t certain how to approach this, so I googled ‘discord UID osint’ to see what resources existed. A plethora of tools came up. To refine my searches further, I started searching for methods of resolving a unix timestamp from a Discord ID.

My searches revealed that discord UIDs are snowflake IDs - that is, they’re based on unix timestamps themselves, simply adjusted with a mathematical formula. The next step then became either finding the formula, or finding a website which can convert the snowflake ID into a unix timestamp.

Googling for this found Snowstamp, a service that does the latter. Putting Nathaniel’s snowflake ID into the search bar immediately gives the unix timestamp.

Rather confusingly, the flag requires the miliseconds value rather than seconds value. Clicking the ‘Units’ toggle resolves this, giving a value of 1704148875324.

Flag: osintuk{1704148875324}

Hidden Beneath The Surface (3pts)

Task: Find the hidden message back in Challenge #1.

Answer Format:

  • Use the osintuk{answer} format.
    e.g. osintuk{abcdefghijklmopqrstuvwxyz}

I’m not ashamed to admit that this took some head scratching.

I initially tried using the ‘inspect’ tool to see if there were any images or hidden text, but couldn’t find any. After that, I screenshotted the challenge itself and put it through Forensically in the hopes that it might reveal some hidden text.

Although it didn’t, it did reveal the full-stop as being far brighter than any other part of the text. A hidden hyperlink!

Inspecting the dot showed it to have a base64 string attached to it.

I decrypted the code using CyberChef, revealing the plaintext: ‘mutinymockoutsin’. At last, we have the flag!

Flag: osintuk{mutinymockoutsin}

True Meanings (3pts)

Task: Identify the relevant anagram from the text in the previous challenge.

Answer Format:

  • Use the osintuk{answer} format.
  • No spaces or special characters.
    e.g. osintuk{abcdefghijklmopqrstuvwxyz}

I immediately saw ‘OSINT’ as being in ‘MUTINYMOCKOUTSIN’. After taking it away, the end result became apparent: ‘UK OSINT COMMUNITY’.

Flag: osintuk{ukosintcommunity}