← All writeups

Operation Polly

May 2026 · OSINT UK CTF · 4 challenges

Relatives (4pts)

Task: Search for someone named “Jessica Smith” who is or was associated with a politician and a judge somewhere in the world. What is Jessica’s previous surname?

Answer Format:

  • Use the osintuk{answer} format.
    e.g. osintuk{Jones}

Of all of the OSINT UK CTF challenges I’ve done so far, this has been the hardest - it’s a challenge I sorely underestimated.

I started by using various Google strings to try and narrow Jessica Smith down to those mentioned alongside politicians and judges. The closest this managed was to find a Facebook thread, which itself wasn’t helpful.

I then tried Wikipedia. The closest target I could get to a Jessica Smith that matched was the page for ‘Jessica Smith (editor)’, which also turned out to be a mild red herring.

My next step was to search for mentions of a ‘Jessica Smith’ in various countries’ court records, but this also didn’t narrow things down.

A few hours later, an idea struck - Wikidata. Wikidata is the structured database of Wikipedia itself, and can be queried at its ‘query’ subdomain using SPARQL. I don’t know how to code in SPARQL - but Claude does.

I asked Claude to search for any relatives (spouses, parents or children) of entities called ‘Jessica Smith’ that may have been judges or politicians. In sparql, these elements are given identifiers: Q16533 for judge, and Q82955 for politician respectively. Running the following query identifies two matching results.

SELECT ?person ?personLabel ?birthName ?childLabel WHERE {
  ?person rdfs:label "Jessica Smith"@en .
  ?person wdt:P40 ?child .
  ?child wdt:P106 ?childOccupation .
  FILTER(?childOccupation IN (wd:Q16533, wd:Q82955))
  OPTIONAL { ?person wdt:P1477 ?birthName }
  SERVICE wikibase:label { bd:serviceParam wikibase:language "en" }
}

Looking at the second result provides the maiden name of ‘Jessica Udall’, which resolves this flag.

Easily the most hard-fought-for 4 points on the platform so far. Take a bow, taskmaster!

Flag: osintuk{Udall}

Occupations (4pts)

Task: Jessica’s son the politician has had several roles. What role did he have in the year 1979?

Answer Format:

  • Use the osintuk{answer} format.
  • Replace any spaces with underscores.
    e.g. osintuk{medical_scribe}

According to Wikidata, Jessica’s politician son is Gordon H. Smith. His Wikidata page lists his job in 1979 as being ‘law clerk’.

Flag: osintuk{law_clerk}

Best Facts Website (5pts)

Task: The politician’s brother is an attorney. What is the username of the person who created his Wikipedia page?

Answer Format:

  • Use the osintuk{answer} format.
    e.g. osintuk{JohnSmith123}

The politician’s brother - or, perhaps simpler for us, Jessica’s other son - is Milan Smith, as listed on her Wikidata page. By going to his Wikipedia page, we just have to click ‘view history’ and visit the earliest entry. In so doing, we find ‘Smashingworth’ to be the page creator.

Flag: osintuk{Smashingworth}

Historic Age (3pts)

Task: You found the right Wikipedia user, but on what date was their account created?

Answer Format:

  • Use the osintuk{answer} format.
  • Use DD/MM/YYYY format.
    e.g. osintuk{21/07/2015}

I could see a ‘Welcome’ message on Smashingworth’s page - giving us an indication that the creation date was around 13th March 2006. This unfortunately isn’t the flag, but we’re close.

The trick here comes from Wikipedia’s Special Pages. These are pages that allow you to query information about pages, Wikipedians, and so on.

This led to me finding a ‘ListUsers’ page, where you can search for all users with active Wikipedia accounts - and can even sort by account creation date. Searching for ‘Smashingworth’ here gives a creation date of 27th February 2006.

Flag: osintuk{27/02/2006}