ctf-osint

Name: ctf-osint
Author: ljagiello

5.9kinstalls330forks

How to install ctf-osint?

ljagiello/ctf-skills/ctf-osint

$npx -y skills add ljagiello/ctf-skills --skill ctf-osint

Installs into the current project.

Summary

Provides open source intelligence techniques for CTF challenges. Use when gathering information from public sources, social media, geolocation, DNS records, username enumeration, reverse image search, Google dorking, Wayback Machine, Tor relays, FEC filings, or identifying unknow

Files · 1

View on GitHub

SKILL.md

1	# CTF OSINT
2
3	Quick reference for OSINT CTF challenges. Each technique has a one-liner here; see supporting files for full details.
4
5	## Prerequisites
6
7	Python packages (all platforms):
8	```bash
9	pip install shodan Pillow
10	```
11
12	Linux (apt):
13	```bash
14	apt install whois dnsutils nmap libimage-exiftool-perl imagemagick curl
15	```
16
17	macOS (Homebrew):
18	```bash
19	brew install whois bind nmap exiftool imagemagick curl
20	```
21
22	## Additional Resources
23
24	- [social-media.md](social-media.md) - Twitter/X (user IDs, Snowflake timestamps, Nitter, memory.lol, Wayback CDX), Tumblr (blog checks, post JSON, avatars), BlueSky search + API, Unicode homoglyph steganography, Discord API, username OSINT (namechk, whatsmyname, Osint Industries), username metadata mining (postal codes), platform false positives, multi-platform chains, Strava fitness route OSINT
25	- [geolocation-and-media.md](geolocation-and-media.md) - Image analysis, reverse image search (including Baidu for China), Google Lens cropped region search, reflected/mirrored text reading, geolocation techniques (railroad signs, infrastructure maps, MGRS), Google Plus Codes, EXIF/metadata, hardware identification, newspaper archives, IP geolocation, Google Street View panorama matching, What3Words micro-landmark matching, Google Maps crowd-sourced photo verification, Overpass Turbo spatial queries, music-themed landmark geolocation with key encoding
26	- [web-and-dns.md](web-and-dns.md) - Google dorking (including TBS image filters), Google Docs/Sheets enumeration, DNS recon (TXT, zone transfers), Wayback Machine, FEC research, Tor relay lookups, GitHub repository analysis, Telegram bot investigation, WHOIS investigation (reverse WHOIS, historical WHOIS, IP/ASN lookup), fake service banner detection via nmap fingerprinting
27
28	---
29
30	## When to Pivot
31
32	- If you already have the files or packets locally and now need extraction or carving, switch to `/ctf-forensics`.
33	- If the task becomes active exploitation of a live HTTP service, switch to `/ctf-web`.
34	- If you uncover malware samples, beacons, or suspicious binaries during attribution, switch to `/ctf-malware`.
35
36	## Quick Start Commands
37
38	```bash
39	# DNS recon
40	dig -t any target.com
41	dig -t txt target.com
42	dig axfr @ns.target.com target.com
43	whois target.com
44
45	# Image metadata
46	exiftool image.jpg
47	identify -verbose image.jpg \| head -30
48
49	# Web archive
50	curl "https://web.archive.org/web/20230101*/target.com"
51
52	# Username lookup
53	curl -s "https://whatsmyname.app/api/lookup?username=<user>"
54
55	# Shodan
56	shodan search "hostname:target.com"
57	shodan host <ip>
58	```
59
60	## String Identification
61
62	- 40 hex chars -> SHA-1 (Tor fingerprint)
63	- 64 hex chars -> SHA-256
64	- 32 hex chars -> MD5
65
66	## Twitter/X Account Tracking
67
68	- Persistent numeric User ID: `https://x.com/i/user/<id>` works even after renames.
69	- Snowflake timestamps: `(id >> 22) + 1288834974657` = Unix ms.
70	- Wayback CDX, Nitter, memory.lol for historical data. See [social-media.md](social-media.md).
71
72	## Tumblr Investigation
73
74	- Blog check: `curl -sI` for `x-tumblr-user` header. Avatar at `/avatar/512`. See [social-media.md](social-media.md).
75
76	## Username OSINT
77
78	- [whatsmyname.app](https://whatsmyname.app) (741+ sites), [namechk.com](https://namechk.com). Watch for platform false positives. See [social-media.md](social-media.md).
79
80	## Image Analysis & Reverse Image Search
81
82	- Google Lens (crop to region of interest), Google Images, TinEye, Yandex (faces). Check corners for visual stego. Twitter strips EXIF. See [geolocation-and-media.md](geolocation-and-media.md).
83	- Cropped region search: Isolate distinctive elements (shop signs, building facades) and search via Google Lens for better results than full-scene search. See [geolocation-and-media.md](geolocation-and-media.md).
84	- Reflected text: Flip mirrored/reflected text (water, glass) horizontally; search partial text with quoted strings. See [geolocation-and-media.md](geolocation-and-media.md).
85
86	## Geolocation
87
88	- Railroad signs, infrastructure maps (OpenRailwayMap, OpenInfraMap), process of elimination. See [geolocation-and-media.md](geolocation-and-media.md).
89	- Street View panorama matching: Feature extraction + multi-metric image similarity ranking against candidate panoramas. Useful when challenge image is a crop of a Street View photo. See [geolocation-and-media.md](geolocation-and-media.md).
90	- Road sign OCR: Extract text from directional signs (town name

People who liked this also viewed

6 picks

Type

ctf-osint

5.9kinstalls330forks

View on GitHub

How to install ctf-osint?

ljagiello/ctf-skills/ctf-osint

$npx -y skills add ljagiello/ctf-skills --skill ctf-osint

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# CTF OSINT
2
3	Quick reference for OSINT CTF challenges. Each technique has a one-liner here; see supporting files for full details.
4
5	## Prerequisites
6
7	Python packages (all platforms):
8	```bash
9	pip install shodan Pillow
10	```
11
12	Linux (apt):
13	```bash
14	apt install whois dnsutils nmap libimage-exiftool-perl imagemagick curl
15	```
16
17	macOS (Homebrew):
18	```bash
19	brew install whois bind nmap exiftool imagemagick curl
20	```
21
22	## Additional Resources
23
24	- [social-media.md](social-media.md) - Twitter/X (user IDs, Snowflake timestamps, Nitter, memory.lol, Wayback CDX), Tumblr (blog checks, post JSON, avatars), BlueSky search + API, Unicode homoglyph steganography, Discord API, username OSINT (namechk, whatsmyname, Osint Industries), username metadata mining (postal codes), platform false positives, multi-platform chains, Strava fitness route OSINT
25	- [geolocation-and-media.md](geolocation-and-media.md) - Image analysis, reverse image search (including Baidu for China), Google Lens cropped region search, reflected/mirrored text reading, geolocation techniques (railroad signs, infrastructure maps, MGRS), Google Plus Codes, EXIF/metadata, hardware identification, newspaper archives, IP geolocation, Google Street View panorama matching, What3Words micro-landmark matching, Google Maps crowd-sourced photo verification, Overpass Turbo spatial queries, music-themed landmark geolocation with key encoding
26	- [web-and-dns.md](web-and-dns.md) - Google dorking (including TBS image filters), Google Docs/Sheets enumeration, DNS recon (TXT, zone transfers), Wayback Machine, FEC research, Tor relay lookups, GitHub repository analysis, Telegram bot investigation, WHOIS investigation (reverse WHOIS, historical WHOIS, IP/ASN lookup), fake service banner detection via nmap fingerprinting
27
28	---
29
30	## When to Pivot
31
32	- If you already have the files or packets locally and now need extraction or carving, switch to `/ctf-forensics`.
33	- If the task becomes active exploitation of a live HTTP service, switch to `/ctf-web`.
34	- If you uncover malware samples, beacons, or suspicious binaries during attribution, switch to `/ctf-malware`.
35
36	## Quick Start Commands
37
38	```bash
39	# DNS recon
40	dig -t any target.com
41	dig -t txt target.com
42	dig axfr @ns.target.com target.com
43	whois target.com
44
45	# Image metadata
46	exiftool image.jpg
47	identify -verbose image.jpg \| head -30
48
49	# Web archive
50	curl "https://web.archive.org/web/20230101*/target.com"
51
52	# Username lookup
53	curl -s "https://whatsmyname.app/api/lookup?username=<user>"
54
55	# Shodan
56	shodan search "hostname:target.com"
57	shodan host <ip>
58	```
59
60	## String Identification
61
62	- 40 hex chars -> SHA-1 (Tor fingerprint)
63	- 64 hex chars -> SHA-256
64	- 32 hex chars -> MD5
65
66	## Twitter/X Account Tracking
67
68	- Persistent numeric User ID: `https://x.com/i/user/<id>` works even after renames.
69	- Snowflake timestamps: `(id >> 22) + 1288834974657` = Unix ms.
70	- Wayback CDX, Nitter, memory.lol for historical data. See [social-media.md](social-media.md).
71
72	## Tumblr Investigation
73
74	- Blog check: `curl -sI` for `x-tumblr-user` header. Avatar at `/avatar/512`. See [social-media.md](social-media.md).
75
76	## Username OSINT
77
78	- [whatsmyname.app](https://whatsmyname.app) (741+ sites), [namechk.com](https://namechk.com). Watch for platform false positives. See [social-media.md](social-media.md).
79
80	## Image Analysis & Reverse Image Search
81
82	- Google Lens (crop to region of interest), Google Images, TinEye, Yandex (faces). Check corners for visual stego. Twitter strips EXIF. See [geolocation-and-media.md](geolocation-and-media.md).
83	- Cropped region search: Isolate distinctive elements (shop signs, building facades) and search via Google Lens for better results than full-scene search. See [geolocation-and-media.md](geolocation-and-media.md).
84	- Reflected text: Flip mirrored/reflected text (water, glass) horizontally; search partial text with quoted strings. See [geolocation-and-media.md](geolocation-and-media.md).
85
86	## Geolocation
87
88	- Railroad signs, infrastructure maps (OpenRailwayMap, OpenInfraMap), process of elimination. See [geolocation-and-media.md](geolocation-and-media.md).
89	- Street View panorama matching: Feature extraction + multi-metric image similarity ranking against candidate panoramas. Useful when challenge image is a crop of a Street View photo. See [geolocation-and-media.md](geolocation-and-media.md).
90	- Road sign OCR: Extract text from directional signs (town name

People who liked this also viewed

6 picks

Type