Capture The Flag

OSINT Challenges

Test your open source intelligence tradecraft. Nine challenges from beginner to expert level.

Beginner

Digital Footprint

Map a complete digital identity using only a username across 400+ platforms and services.

01. Deploy OSINT framework and configure module chain 02. Execute username search across 400+ platforms 03. Document all discovered profiles and associated metadata 04. Cross-reference profile details for identity correlation 05. Extract email hashes and gravatar data 06. Build complete digital identity graph 07. Submit comprehensive findings for scoring
Easy

Metadata Hunter

Extract and weaponize hidden metadata from publicly available documents to build a complete target profile.

01. Acquire and catalog provided document set 02. Extract EXIF data from all image files 03. Parse document metadata including authors and editors 04. Extract GPS coordinates and map locations 05. Identify software versions and device fingerprints 06. Extract revision history with author timeline 07. Correlate metadata points across document set 08. Generate comprehensive attribution profile
Easy

DNS Trail

Follow the complete DNS trail to map infrastructure, discover subdomains, and identify hidden services.

01. Initialize DNS enumeration on target domain 02. Query all record types: A, AAAA, MX, NS, TXT, CNAME, SOA 03. Execute recursive subdomain brute-force 04. Search certificate transparency logs for issued certs 05. Identify cloud providers and hosting infrastructure 06. Map CDN origins and WAF providers 07. Document complete attack surface with IP ranges 08. Generate infrastructure relationship diagram
Medium

Breach Analyst

Correlate breach data across 12+ sources to identify a target's complete credential exposure and risk profile.

01. Query target email across primary breach databases 02. Cross-reference credentials across secondary sources 03. Identify password reuse patterns and variants 04. Map associated accounts and linked services 05. Extract security questions and recovery data 06. Calculate composite exposure risk score 07. Generate executive breach impact report 08. Recommend mitigation actions based on findings
Medium

GeoINT Challenge

Use advanced geolocation intelligence to identify precise locations from photographs with minimal visible clues.

01. Extract and analyze all image EXIF metadata 02. Examine shadow angles and calculate sun position 03. Identify vegetation biomes and geological features 04. Analyze architectural styles and infrastructure 05. Cross-reference with satellite and street imagery 06. Use RF fingerprinting for cell tower triangulation 07. Narrow to precise coordinates with confidence interval 08. Submit location with detailed reasoning chain
Medium

Dark Web Scout

Navigate dark web markets to locate a specific listing, analyze vendor operations, and extract actionable intelligence.

01. Configure secure torified environment with isolation 02. Navigate to target marketplace with OPSEC measures 03. Search for specific product category and listing 04. Analyze vendor reputation history and feedback patterns 05. Extract operational security posture and OPSEC gaps 06. Trace cryptocurrency transaction patterns 07. Document vendor infrastructure relationships 08. Compile actionable intelligence report with evidence
Hard

Social Engineering Canvas

Build a complete organizational profile through passive OSINT to identify key personnel, relationships, and vulnerabilities.

01. Map organizational hierarchy from public disclosures 02. Identify key personnel with role-based targeting 03. Extract email patterns and naming conventions 04. Analyze employee social media for cross-posting 05. Map professional relationships on LinkedIn 06. Identify third-party vendors and partnerships 07. Document physical security posture from photos 08. Compile social engineering attack surface dossier
Hard

Network Mapper

Map an organization's entire digital infrastructure using only open-source intelligence tools and passive techniques.

01. Enumerate all public-facing IP ranges and ASNs 02. Execute passive port fingerprinting on discovered hosts 03. Identify service banners and software versions 04. Discover shadow IT and forgotten cloud assets 05. Map content delivery networks and origin servers 06. Identify WAF, proxy, and security infrastructure 07. Document SSL/TLS certificate chain and CAs 08. Generate complete infrastructure topology diagram
Expert

Identity Deconstruction

Deconstruct a sophisticated pseudonymous identity across 100+ platforms to reveal real-world attribution with high confidence.

01. Collect all known aliases, handles, and digital artifacts 02. Cross-reference identity fragments across 100+ platforms 03. Analyze temporal posting patterns and timezone mapping 04. Extract linguistic fingerprint with stylometric analysis 05. Correlate cross-platform metadata and device signatures 06. Map social graph and network relationships 07. Apply advanced identity resolution algorithms 08. Build court-admissible attribution case with confidence scoring