← All writeups

Operation Zuck

May 2026 · OSINT UK CTF · 4 challenges

Wait How Long Ago? (5pts)

Task: Identify exactly when Mark Zuckerberg’s Facebook account was created.

Answer Format:

  • Use the osintuk{answer} format.
  • The answer should use GMT timezone.
  • Enter the date in the format DD/MM/YYYY.
  • Enter the time in the format HH:MM:SS.
  • Separate the date and time with an underscore.
    e.g. osintuk{02/07/2013_21:03:34}

I started by navigating to Mark Zuckerberg’s profile and digging around in the source code. As the challenge asked for the exact time down to the second, I was certain this challenge would involve finding a UNIX timestamp and converting it into real time.

I started by finding Zuckerberg’s Facebook profile through a cursory Google search. I then looked inside the page source to see if anything stood out, but nothing did.

I then moved to the debugger. I know that UNIX timestamps are (as far as modern humans ever need to care) 10 digits long. In order to identify integer strings of this length, I did the following:

As the below shows, this unfortunately covers quite a lot of strings - some of which might be plausible as UNIX strings, some of which certainly aren’t. I needed a way to narrow this selection down.

While mulling this over, I ran a quick Google search to see if there was any standard, known tool or method to get the creation timestamp from a Facebook profile. In so doing, I found this article by Craig Silverman, which points out that Facebook creation years can be found on any Facebook account’s ‘marketplace’ profile.

Although the rest of the article was paywalled, I thought this worth taking a look. If the year of creation is visible on a marketplace profile, then perhaps the UNIX timestamp is available in the page source.

To get to a profile’s marketplace equivalent, simply add ‘marketplace/profile/’ in the URL between facebook.com and the following user ID, like so:

https://www.facebook.com/4 - Mark Zuckerberg’s Facebook profile. https://www.facebook.com/marketplace/profile/4 - Mark Zuckerberg’s Facebook Marketplace profile.

In so doing, I was immediately rewarded by seeing a registration year of 2004.

This gave me enough confidence to start digging around in the page’s source code. I started querying terms like ‘creation’, ‘registration’ and variations thereof. Querying ‘registration_’ found the term ‘registration_time’, which was followed by a far more plausible-looking UNIX timestamp.

I used Epoch Converter to change the timestamp from UNIX to readable, which gave a creation date of 11th February 2004, 21:34:27 - and ergo the flag. A very tricky start!

Flag: osintuk{11/02/2004_21:34:27}

Marketplace Mystery (3pts)

Task: Mark Zuckerberg appears to have only ever sold 1 item on Facebook Marketplace. What is the numeric ID from the URL of that marketplace listing?

Answer Format:

  • Use the osintuk{answer} format.
  • Digits only.
    e.g. osintuk{287492981473}

To start, let’s go back to Mark’s Facebook Marketplace page. By searching for ‘sold and out of stock’ listings, we can see that he sold an OG Facebook Hoodie.

Hovering over the hoodie provides the marketplace listing ID in the URL preview: 695154036144567.

Flag: osintuk{695154036144567}

Book Club (4pts)

Task: The OG Facebook Hoodie listing had one photo of it on a table next to some books. Identify the authors of the book that shows the word “SECURITY” on it.

Answer Format:

  • Use the osintuk{answer} format.
  • Replace spaces with underscores.
  • Separate both names with an underscore.
  • Enter the names in alphabetical order.
    e.g. osintuk{Alfie_Jones_John_Smith}

I started by going to the marketplace listing and navigating to the photo with books mentioned.

I realigned the image in PowerPoint and uploaded a screenshot of the now-straightened image to Google Lens. Initial results didn’t even pick up that it was a book (somewhat concerning), but adding ‘book’ to the search term identified a matching volume by Benjamin Graham.

With this identified, a simple Google search - or even clicking on the links therein - reveal the two authors to be Benjamin Graham and David Dodd.

Flag: osintuk{Benjamin_Graham_David_Dodd}

Gamerz (4pts)

The person who won the OG Facebook hoodie more recently sold it at auction. He has mentioned in interviews selling it for a particular reason, a team that means a lot to him and others.

Task: Identify the relevant team and find their team email address.

Answer Format:

As ever, I started by Googling the basic facts of the claim. This led to a single search result with an interesting pivot point from which to go further: an amount for how much the hoodie sold.

I followed this search with ‘zuckerberg og facebook hoodie $15,875’. This, in turn, led to a Business Insider article which lists the Marketplace purchaser as having been Matt Thompson.

As a fun addendum, it even includes a picture of Matt and his (formerly) prized possession.

Of more relevance, though, is the following snippet - showing him as linked to Huckabay ISD’s esports team.

A search for the team reveals their website and Facebook page quickly. I wasn’t able to load their website due to (unexpectedly ominous) browser security warnings, but their Facebook page contains their email address regardless - and thus resolves this flag.

Flag: osintuk{ironcladesports@hisd.us}

Facebook or Google (3pts)

Task: Identify the Google ID associated with the email from the previous challenge.

Answer Format:

  • Use the osintuk{answer} format.
  • Digits only.
    e.g. osintuk{14781904789274897}

Epieos host a modified version of Holehe on their website, which allows users to identify a swathe of information concerning queried email addresses - particularly those with Google accounts.

Entering the target email address into Epieos gives the desired Google ID: 102493220079197346408.

Flag: osintuk{102493220079197346408}

And with that, another operation is complete!