osint ctf hints
spoiler-free hints for osint challenges.
geolocation · reverse image search · username enumeration · domain recon · social media · metadata
what osint ctf challenges look like
OSINT challenges give you a photo, a username, a name, or a domain and ask you to find something using only public information — a location, a hidden account, a real identity, or an exposed server. the work is following clues from one source to the next, never touching the target directly.
common osint challenge types
- geolocationidentify where a photo was taken — read signage, language, architecture, license plates, road markings, and sun position. confirm guesses in Google Street View.
- reverse image searchfind where else an image appears. run it through Google Lens, Yandex (best for faces/places), and TinEye. crop to the distinctive part for better matches.
- username enumerationpivot a single handle across platforms with Sherlock or WhatsMyName to find linked accounts and leaked profile details.
- domain & WHOIS reconcheck WHOIS, DNS records, and certificate transparency (crt.sh) to find subdomains, registrant info, and related infrastructure.
- social media investigationreconstruct a timeline from posts, replies, follower graphs, and tagged locations. archived versions (Wayback Machine) recover deleted content.
- metadata / EXIFdownload the original file and read EXIF with exiftool — GPS coordinates, device model, and timestamps are often left in uploaded images.
- Google dorkinguse site:, filetype:, intitle:, and inurl: operators to surface exposed documents and pages that contain the answer.
useful tools
Yandex / Google Lens / TinEye for reverse image search · Google Street View for geolocation · Sherlock / WhatsMyName for usernames · exiftool for metadata · crt.sh and dnsdumpster for domains · the Wayback Machine for deleted content · Google dorks for exposed files.
faq
how do I geolocate a photo?+
read the visible clues — signage and language, architecture, license plates, road markings, vegetation, and the sun’s position — to narrow a region, then confirm the exact spot in Google Street View. if the image appears online, a reverse image search can shortcut the whole search.
how do I link a username across platforms?+
run the handle through Sherlock or WhatsMyName to enumerate accounts that use it, then confirm they are the same person by matching avatars, bios, writing style, and email patterns. one shared detail across two profiles is usually enough to pivot.
what tools do OSINT players rely on?+
reverse image search (Google Lens, Yandex, TinEye), Sherlock and WhatsMyName for usernames, WHOIS/DNS and certificate transparency (crt.sh) for domains, exiftool for image metadata, and the Wayback Machine for content that has since been deleted.