VeiledAthena
Operation Spotter
The Keyword Search (3pts)
Task: A domain name containing the keyword “trainspotter” was registered on June 28, 2012. What is the full domain name?
Answer Format:
- Use the osintuk{answer} format.
- Enter only the domain name.
e.g. osintuk{example.com}
To crack this clue, we need to use Whoxy. Whoxy allows for domain lookup by keyword, allowing us to filter past all of the film-related noise that we’d otherwise find via standard Google searching.
Doing so quickly finds the first flag - ‘trainspotterspotting.com’.
Flag: osintuk{trainspotterspotting.com}
The Registrant (3pts)
Task: Identify the name listed in historic WHOIS records for the domain from the previous challenge.
Answer Format:
- Use the osintuk{answer} format.
- Use an underscore between first and last name.
e.g. osintuk{John_Smith}
I participated in an OSINT CTF several years ago which introduced me to Whoisfreaks WHOIS Historical Lookup tool. This challenge seems like the perfect fit. Doing so finds our target - Graham Allen.
Flag: osintuk{Graham_Allen}
The Predecessor (3pts)
Task: We believe the trainspotting domain was owned prior to 2012 too. Identify the individual’s name that was written on the home page.
Answer Format:
- Use the osintuk{answer} format.
- Use an underscore between first and last name.
e.g. osintuk{John_Smith}
The challenge indicates a need for the Wayback Machine, where we can search for archived copies of the website. Looking at near-any copy of the website pre-2013 gives the name Paul Rodwell - including this copy, from a bygone age of the internet (2005).
Flag: osintuk{Paul_Rodwell}
The Deleted User Comment (5pts)
A video featuring trainspotter Francis Bourgeois was posted here:
A user posted the following comment, but later deleted their account:
“I wish I could experience just a fraction of this guys joy in life, what an absolute beauty”.Task: What was the username of the account that posted this comment?
Answer Format:
- Use the osintuk{answer} format.
- Enter the Reddit username at the time of the post.
e.g. osintuk{R3dd1t_U5eR}
I was wondering if there might be an updated Reddit tool to tackle this following the death of the Pushshift Archive a few years ago. Before getting into the thickets of that, I wanted to make sure the fundamentals were covered. Back to the Wayback Machine I went.
Sure enough, the thread’s been archived.
I was able to find an archived copy of the page with the comments from Christmas Day 2021, but - annoyingly - the usernames aren’t visible on the cached version.
I know the user data is likely to be embedded somewhere - just not displaying properly. Hovering over the space to the left of ‘3 days ago’, where the user’s avatar would usually be, is sufficient to reveal their username. Diving into the page source also works.
Flag: osintuk{Xae_sthetic}
Short and sweet.