Open-Source Intelligence
Open-Source Intelligence (OSINT) is the discipline of gathering and analyzing information from publicly available sources. In CTFs it maps to a concrete set of skills: extracting hidden metadata from files, recovering data that survives poor redaction, geolocating images from coordinate clues, reading network traffic for identity traces, and hunting credentials through breach databases. These techniques are used daily by threat-intel analysts, investigative journalists, and security researchers.
Guides for this path
Read these alongside the challenges below. The first one orients you; the rest go deeper on the techniques each step needs.
- OSINT for CTF: How to Turn Public Data Into a FlagOSINT for CTF: identify a CVE from a prose description, recover redacted text, geolocate from EXIF, read identity out of a pcap, and profile credentials.
- Document Forensics for CTF: PDFs, Office Files, and Everything strings MissesPulling flags out of PDFs and Office documents: failed redaction, hidden slides, tracked changes, VBA macros, embedded objects, and why strings finds none of it.
- Image Metadata and EXIF Forensics for CTFEXIF metadata forensics for CTF: the flag hides in metadata, not pixels. Use exiftool, PNG text chunks, thumbnails, and strings to pull flags from EXIF and XMP.
- Wireshark and pcap Analysis for CTF ForensicsWireshark and tshark for CTF: analyze pcap files, follow TCP streams, find credentials, extract files, reconstruct DNS exfiltration, and apply display filters.
- Hash Cracking for CTF: MD5, SHA-1, SHA-256 and Beyond (picoCTF 2026)Hash cracking for CTF: identify hash types, run hashcat and John the Ripper, use rainbow tables and online lookups, and solve picoCTF 2026 and 2025 hash challenges.
- Web Recon for CTF: robots.txt, Page Source, DevTools, and Hidden EndpointsYour first web CTF recon playbook: view-source, DevTools, robots.txt, exposed .git, directory brute-forcing with ffuf and gobuster, cookies, and when to open Burp.
- Step 01
Redacted? Not Quite
Organizations regularly publish documents they believe are sanitized, but the data often survives. A black rectangle drawn over text in a PDF is a cosmetic layer - the words beneath are still extractable. An SVG file stores its shapes as XML, so a flag hidden as a text node is invisible on screen but readable in the source. These challenges build the habit of looking at what a file actually contains rather than what it renders.
- Step 02
Geolocation from Evidence
Images and coordinate data reveal location even when no one intends them to. Reverse geocoding turns GPS coordinates into place names; satellite imagery lets you match landmarks in an untagged photo. Mr-Worldwide encodes a flag by mapping coordinates to city names, and Blast from the Past tests your understanding of how EXIF timestamp fields are structured and what it takes to verify or backdate them.
- Step 03
Network and Protocol Footprints
Network traffic carries identity. A BitTorrent session broadcasts an info_hash that identifies the exact file being downloaded, and that hash traces back to a named torrent in public indexes. A captured Wi-Fi handshake contains enough cryptographic material to crack the passphrase offline using a dictionary. These challenges show how protocols designed purely for function leave an investigatable trail.
- Step 04
Credential Intelligence
Billions of credentials from past data breaches circulate in public dumps. OSINT investigators query them to surface accounts, identify password reuse patterns, and understand a target's digital habits. Password profiling tools like CUPP generate targeted wordlists from personal details gathered through open sources. These two challenges sit at the intersection of OSINT and credential security.