CTF@CIT 26 | OSINT Challenges Write-up

Sup! It's Pizza Steve back with another write-up for all the OSINT challenges in CTF@CIT 26.

First things first, shout out to the amazing organizing team (fr one of the best I've seen), from the quality of the challenges to their continuous support. Can't forget my teammates and their hard effort that resulted in #16 out of 1100+ teams!

Follow the Flock

Man these damn seagulls keep following me around... always in a flock, obnoxious sirens blaring.
And they smell like pizza.

Feels like I'm being watched everywhere I go...

FLAG FORMAT: CIT{Street_Name_City_Name_State}

Hint: This specific city in Connecticut is known for its style of Pizza.

So, this basically was the easiest one. We are given clear identifiers for the location we are after, and the hint narrowed down the search: "This specific city in Connecticut is known for its style of pizza."

Utilizing the overview feature, we are halfway through the flag. We just need to get the street name now. Here we use the specific identifiers:

1- Smell like pizza
2- Always in a flock
3- Obnoxious sirens blaring
4- Watched everywhere I go

Doing some research, we land on many candidates, but the differentiator was "the obnoxious sirens," which led us to State Street.

State Street is the "echo chamber" of New Haven. It is a main bypass for ambulances and police cruisers.

Flag: CIT{State_Street_New_Haven_CT}

Cartographer's Secret

Solve Follow the Flock first

I swear I've looked everywhere...

Maybe I'm not looking closely enough.

FLAG FORMAT: CIT{underscore_between_words}

Hint: This CTF is hosted by who?

This one was not clear for me at the beginning. The hint landed us on the University of New Haven, but then...?

Attention to detail and connecting the dots will serve you here. This is the second part of the first challenge, Follow the Flock.

"Flock" refers to Flock Safety cameras.

Searching for a correlation between the host and Flock led us to...

So now, we are trying to figure out another relation between ALPR and the university.

I struggled to find the connecting dot here until the author said, "search sites related to those cameras." It turns out those cameras are like radar that snaps things like speeding violations and fines you later. Moreover, the US also has sites for those radar locations lol.

With that in mind, we find Deflock, which is here for that. Searching for the camera at the University of New Haven gets us to the finish line.

Flag: CIT{ch3ck_th3_OSM_t4gs}

Has it really been 2 years?

Has it really been 2 years...? Find the name of this menu item

Before identifying the item, we need to identify the restaurant, right?

Take a close look.

In 1, we can see the name ending with "OW" and "Cafe" beneath it. In 2, the name starts with "W". In 3, this looks like a chicken tender (yes, we will use this info later).

We can conclude the full name is probably WoW Cafe. Now we search and compare the results with the logo we have.

Before confirming a match, I looked up Yelp and found the same serving paper being used here, so... BINGOO!

The restaurant menu was available, however, I spent hours trying to find a pickles sandwich. I traced the restaurant's social media platforms for any limited-time sandwich post. I even used the Wayback Machine to check if this was some special item two years ago (hence the name), but no luck.

Here, info "3" helped us. Most teams were after a pickles sandwich, but in fact, the author removed the tender piece from the sandwich 😆

After hours of searching, the author hinted toward "ID where the restaurant is located and see if there's a similar account in the dining space."

I immediately speculated the account to be a host-related one, and I was correct.

I found an Instagram account for the dining space at the university, where they share food menus and events.

Going through the posts from two years ago, I found our target.

Flag: CIT{CHICK-N-DAWG}

The Forbidden Sock

Our friend is really exposing himself out in public where is he??

FLAG FORMAT: CIT{Team_Section_#}

This one felt like a release. We can reverse search the image to find the stadium. Then we can use its ticketing system since it displays a 3D view of the stadium while picking a seat.

The stadium is Fenway Park, where the Boston Red Sox play their home games.

From the task image, we can see a US flag, three lights, and a huge sponsor banner. Hence, we can conclude we are sitting somewhere in the red box.

Although the challenge only required the section number, I took it to another level. I went for the exact seat number.

From the task image, we can use two clues for this: the white line and the entrance door with a warning on it.

The numbers in indigo are used to count the columns; the green are for rows. We can guess the seat number is 6 seats to the left of the stairs and 7 chairs up, leaving us at Section B7, R.F. Box 7, Row D, Seat 16.

However, the challenge only required the section number.

Flag: CIT{RedSox_Section_7}

Yannella

This challenge is dedicated to our late friend Anthony Yannella.

Find the organization that gave Anthony an acknowledgment for responsibly disclosing a security vulnerability.

Flag format: CIT{name_of_organization}

I started by searching for "Anthony Yannella." An Instagram account showed up, and the bio included "Security Researcher / Cybersecurity and networks major," so I knew I found the correct person.

But now we want a platform where he shares his progress, so we look up his LinkedIn.

I found his LinkedIn, scrolled down to the Honors & Awards section, and found our flag.

Flag: CIT{Department_of_Energy}

The Curator's Exit

We've received a communication from Interpol, containing a PDF.
We are unsure of the contents, but believe it contains information on one of the thieves from the Louvre Heist.
Your job is to find out as much as you can about this individual and send the information back to the authorities.

What is the thief's name?

FLAG FORMAT: CIT{First_Last}

And we were provided with a password-protected PDF. At first, I assumed the password would be related to what had been posted about the Louvre heist, so I tried one of the passwords the system admins used, Louvre. When that failed, I tried another password used for their cybersecurity system, Thales, but that did not work either.

So, we need to crack the password using john2pdf.

$ john --wordlist=/usr/share/wordlists/passwords/rockyou.txt please.hash
Using default input encoding: UTF-8
Loaded 1 password hash (PDF [MD5 SHA2 RC4/AES 32/64])
Cost 1 (revision) is 6 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:05 0.04% (ETA: 09:09:48) 0g/s 1379p/s 1379c/s 1379C/s bball23..ashley13
0g 0:00:00:08 0.06% (ETA: 09:08:02) 0g/s 1378p/s 1378c/s 1378C/s brady..merda
0g 0:00:00:42 0.34% (ETA: 09:10:43) 0g/s 1380p/s 1380c/s 1380C/s panda15..melina1
cherell          (?)
1g 0:00:02:16 DONE (2026-04-18 05:45) 0.007319g/s 1372p/s 1372c/s 1372C/s chino3..champ03
Use the "--show --format=PDF" options to display all of the cracked passwords reliably
Session completed.

The password is cherell.

After looking through the PDF, the only useful info is the target's handle: VitrineFox.

You know the drill, first thing to do is sherlock it.

[*] Checking username VitrineFox on:

[+] 7Cups: https://www.7cups.com/@VitrineFox
[+] Apple Discussions: https://discussions.apple.com/profile/VitrineFox
[+] Archive.org: https://archive.org/details/@VitrineFox
[+] ArtStation: https://www.artstation.com/VitrineFox
[+] Linktree: https://linktr.ee/VitrineFox
[+] NationStates Nation: https://nationstates.net/nation=VitrineFox
[+] NationStates Region: https://nationstates.net/region=VitrineFox

Among the many links we got, one stood out: Linktree.

Since we are after his name, the first thing to check is his LinkedIn.

His account was empty, but the last thing we needed to check was the contact info.

This OPSEC failure revealed his name: Remy Beauvillier.

Flag: CIT{remy_beauvillier}

The Curator's Exit - Part 2

Check the archives

The first thing that came to mind was checking the archive link we got from the Sherlock output. However, make sure to type the username in all lowercase or you will get an error.

Flag: CIT{N0thing_st4ys_h1dden_for3ver}

The Curator's Exit - Part 3

Our friend was planning their last big score, any idea where?
FLAG FORMAT: CIT{City_Country}

Checking his X account, we find an empty profile with one picture and the caption: "Post score = Vacation Mode Activated," so we are on the right path.

Reverse searching this leads us to the birthplace of Leonardo da Vinci, which is in Anchiano, Italy.

Flag: CIT{Anchiano_Italy}

The Curator's Exit - Final

Our friend is something of a builder, can you find the final flag?

The description hints toward the last link: PCPartPicker.

The last flag is found in the PDF link.

Flag: CIT{N0t_ev3ryth1ng_i$_s3cur3}