drsh0's llog

Sharing some notes I recorded during @AletheDenis' OSINT CTF Strategy and Tactics II event back in September 2020. I hope it helps!

It covers some tips, strategies, and common mistakes to avoid in order to get the most out of OSINT CTFs.

#osint #ctf

Tips

1. Zoom! Enhance
2. There is no substitution for scrolling
   • scroll geolocated posts on IG
   • scroll profile posts+tweets
3. Screen cap or it didn't happen.
4. Link usernames to other profiles.
5. Family trees have handy information

Takeaways

Collection

• Annotations are fine on screenshots for proof. However, evaluate the time it will take vs being able to concisely provide links and information using text.

Tools

• Tools aren't really required to do good OSINT work. It ends up just complicating your workflow. Focus on good analysis.

Strategy

• You should be able to submit a few hundred points in the first 30 mins. If you can't the subject may not have enough information to analyse.

• Sometimes you cannot submit the same link twice. To get around this, submit a link to the specific post or information. This can sometimes be done via permalinks and via embed/share options.

• Aim for 150-200 points in the first 20 minutes. This creates a good feedback loop for your brain to keep looking.

• Low point flags must be submitted — STACK and LAYER until you hit a wall. Rinse and repeat.

• Aim: decrease Time:Points ratio.

Submissions

• Build your case with low point flags e.g. facebook profile —> confirmed. Utilise this to build bigger flags and mention that “since the fb account was confirmed previously...”

• You won't always have the same judge. Therefore, always substantiate – especially towards the end.

• Create rapport with your judge where possible. E.g. a group chat with the judge and your team in Slack (DM).

Submission Example

e.g. sister's fb page

• Screenshot of information [the flag]
• Proof = public link to sister's fb page
• Relevance = “there could potentially be comments or interactions on this facebook page relating to the subject”
• Substantiation / Evidence = Include a link to the specific page and write how this is showing the above e.g. sister is talking about the brother 2 weeks before they disappeared.

Analysis

• Make sure you are able to get foundational flags correct and verified. All future and potentially larger flags will depend on this foundation.