Cybersoc Life Online OSINT Challenge

Lets Investigate

voteforme: What US political party does James over here support?

Ans:  Democratic Party

Detail: James commented on the post of brack obama that he miss that guy already so it seems that he like Democratic Party.

growingup: Where did James spend his childhood?

Ans:  York

Detail: This was something new for me and I quite like it, In his twitter bio he mentioned “Born in ///purple.pulse.force, raised in ///push.asking.barn.” In one of his tweet he mentioned what3words this web application can be used to describe precise location.

By using this location I found the answer

choochoo: In what city does James work?

Ans:  Cardiff

Detail: james tweeted the image of cardiff central train station after returing from work.

suntan: What CITY is Sarah going on holiday to at the end of February?

Ans:  Perth

Detail: james replied to the tweet from @sarah_luxton, by reverse image search I found out that the location was Perth in Australia.

wagthetail: The team has been trying to work out where Person of Interest, Sarah, walks her dog. This is part of building up a profile of her movements. Can you have a look to see if you can find the TOWN in which Sarah tends to take the dog out to?

Ans:  Brecon

Detail: In her twitter bio she says “Buster’s favorite place x : 51.947528, -3.393953” so Buster sounds like dog name and the place is Brecon, Wales.

narcissism: There’s a new Person of Interest, George something or other. Can you find anything interesting on him? Something he perhaps thinks you can’t work out?

Ans:  imamazing123

Detail: @GeorgeWatson428(George Watson) in one of his tweets saying that he encrypted his password and in the replies he posted this Base64 encoded string “aW1hbWF6aW5nMTIz” that when decoded turn into “imamazing123”

proppedup: We’ve obtained what we believe to be an office CCTV camera feed. We have reason to suspect that it is overlooking one of the work desks belonging to one of our targets. Can you confirm the COLOUR of the DESK SURFACE and the COLOUR of the DESK LEGS, just so we can be sure of what we’re seeing and task the reconnaissance team further.

Ans:  brown grey

Detail: while looking at George’s tweets & replies found this tweet by @PearceRees office desks with brown top and grey legs,

The numbers on the image threw me off a little bit :)

bluengreen: James has a habit of getting in the way of things ;).

Ans:  icanseeyou

Detail: This one was quite a curve ball, I checked all the activity of james and found nothing then I started from begining and I found that there was something black behind his profile picture. opening the image in new tab got me the flag.

Now I am writing this walkthrough and looking at the background Image I can see the meaning of “bluengreen” hint was the eyes all along :D

clockingout: We’re trying to plan when is best to break into James’ house to plant a bug. What time does he start work? (UK time).

Ans:  2pm

Detail: In this tweet James says “Just finished work…….. That was a tough 8 hours….” If we note the time of tweet and convet the time to GMT and minus 8 hours we will get our time.

meme: We’ve been watching a bloke called George recently, you might have already done some work on him. … In particular, we’re after an access key for a program his company uses so that the team can ex-filtrate information to aid with our ongoing fraud investigations.

Ans:  CTF3404X71

Detail: George tweeted [this(https://twitter.com/GeorgeWatson428/status/1227648566316978176)] image containing the code.

partytime: Our intelligence analysts have reported that a whole bunch of our targets are having a party together on a Saturday night soon. We want to deploy agents to see whats going on, but we can’t risk blowing our cover turning up in a car. The road is pretty quiet and the property has very clear view of its surroundings, our reports suggest. Find the location of the party and the best BUS ROUTE NUMBER to reach the party from Principality Stadium, Cardiff — where the surveillance team will be deployed from.

Ans:  57

Detail: @PearceRees tweeted Address to the party. I searched on google for routes from Principality Stadium, Cardiff and found this website, I used their service to plan a trip and found the route.

leaveamessage: Our analysts have been trying to get proof of a target’s phone number. We want to move ahead with the arrest but we must get evidence that the phone number we’ve got is indeed theirs. We need to be sure. Due to the highly sensitive nature of the case, we cannot confirm the target’s name with you at this time. Please have a look to see if you can find their phone number. When you call the target’s number what are the LAST THREE WORDS you hear (you can also just enter the phone number as your answer and that is fine as well)?

Ans:  Not Found

Detail: After searching for long without finding anything I tried spending 250 points to get the hint.

HINT: "I shouldn't be telling you this but the target's name is Sophie Jones. You're looking for her email address and that could potentially help you get the phone number."

But the problem I faced that the Account related to @Sophjones77 is suspended and no longer availabe. so moving forward was not possible at the moment.

I tried searching @Sophjones77 on twitter and found out that other peoples were also facing this issue.

Overall This was an Intersting Challenge and I ennjoyed doing it.