Author: Ramon Bello

This are the Open Source Intelligence Challenges that I solved during BDSec CTF 2023

Challenge 1: What is Her Name?

I have a cat. Can you find her name?

The author name written below the challenge prompt was NomanProdhan, so I did a quick google search about the name. The results showed Noman Prodhan as a Cyber security expert. I found multiple sources mentioning him as a Cyber Security Expert so I continued my search. I found his Instagram profile and saw the cat after going through some of his posts. Here he mentioned "TunTun".

Flag BDSEC{TunTun}

Challenge 2: Old Client Area

Our sponsor NS TechValley recently changed their billing system and moved the billing/client area to a new domain/sub-domain. Can you fnd the old billing area domain/sub-domain?

Here I just need to list the subdomains or find a domain link on the site's page. I did a passive recon using crt.sh

On visiting clients.nstechvalley.com, it was redirected to the new subdomain "my.nstechvalley.com". The new page contained the billing area. So the flag will be:

flag: BDSEC{clients.nstechvalley.com}

Challenge 3: Operation Cyber Pursuit 0x00

This time, I checked major social media to find possible accounts and found Haxor BD on Instagram. They made post about hacking stuff and I concluded it was Haxor BD

Flag: BDSEC{hax0r_bd}

Challenge 4: E4sy Pe4sy OSINT

A few days ago I went to meet a friend of mine. I took a picture while we were talking. Can you tell me where we met?

My first attempt is to do EXIF check with exiftool to see if the gps loaction was added to the metadata, it didn't prove much of help as there was no gps data. Next is to do a reverse image search, I tried google and bing and I did't get much. Next I tried to look into the photo for clues for where it could be. I saw a logo with inscription "STAR". Next, I found the exact logo online and it belongs to a Bangladeshi tech company called STAR Tech. I thought Star tech was the location but I was wrong.

I began to look for star tech on the map and check photos of it but no avail. Next, I found Star Cineplex, it had the same logo as Star Tech. On giving more attention to the map, I found Sony Square, it has a STAR Cineplex section and I found a similar photo too.

That was it!

Flag:BDSEC{Sony_Square}

Challenge 5: Find Spy

By googling part of the instructions, I soon found an article talking about an Indian Soldier who was allegedly working for an Indian external intelligence unit.

• The name of the soldier was Shah Newaz and he was arrested on October 25, 2018. The description of the soldier in the article matched.

Flag: BDSEC{Shah_Newaz:October_25_2018}

External links

1. crt.sh
2. article