OSINT CTF Strategy and Tactics
It covers some tips, strategies, and common mistakes to avoid in order to get the most out of OSINT CTFs.
- Zoom! Enhance
- There is no substitution for scrolling
- scroll geolocated posts on IG
- scroll profile posts+tweets
- Screen cap or it didn't happen.
- Link usernames to other profiles.
- Family trees have handy information
- Annotations are fine on screenshots for proof. However, evaluate the time it will take vs being able to concisely provide links and information using text.
- Tools aren't really required to do good OSINT work. It ends up just complicating your workflow. Focus on good analysis.
You should be able to submit a few hundred points in the first 30 mins. If you can't the subject may not have enough information to analyse.
Sometimes you cannot submit the same link twice. To get around this, submit a link to the specific post or information. This can sometimes be done via permalinks and via embed/share options.
Aim for 150-200 points in the first 20 minutes. This creates a good feedback loop for your brain to keep looking.
Low point flags must be submitted — STACK and LAYER until you hit a wall. Rinse and repeat.
Build your case with low point flags e.g. facebook profile —> confirmed. Utilise this to build bigger flags and mention that “since the fb account was confirmed previously...”
You won't always have the same judge. Therefore, always substantiate – especially towards the end.
Create rapport with your judge where possible. E.g. a group chat with the judge and your team in Slack (DM).
e.g. sister's fb page
- Screenshot of information [the flag]
- Proof = public link to sister's fb page
- Relevance = “there could potentially be comments or interactions on this facebook page relating to the subject”
- Substantiation / Evidence = Include a link to the specific page and write how this is showing the above e.g. sister is talking about the brother 2 weeks before they disappeared.
- Make sure you are able to get foundational flags correct and verified. All future and potentially larger flags will depend on this foundation.