CTF OSINT Quick Reference

Problem

ctf osint is for CTF OSINT tasks where the clues come from public or semi-public surfaces: usernames, screenshots, DNS domains, Tor fingerprints, GitHub repositories, Telegram bots, FEC donation records, or fake service banners. It helps decide which platform, image, network, or identity path to check and how to cross-validate the result. It is not a scanner, and it does not cover active exploitation or malware analysis.

How it works

• Social and username tracking: use x.com/i/user/, Snowflake IDs, whatsmyname, and namechk to follow accounts before and after renames; check Tumblr x-tumblr-user, BlueSky public APIs, Discord, gaming platforms, and Unicode homoglyph steganography.
• Image and geolocation: start with reverse image search, cropped Google Lens regions, mirrored text reversal, and EXIF/hardware clues; then narrow locations using rail signs, street-view matching, MGRS, Plus Codes, Overpass Turbo, and landmark reasoning.
• Network and identity: inspect TXT, CNAME, MX, Wayback CDX, GitHub commits/PRs/issues, WHOIS history, Tor metrics, Shodan fingerprints, and FEC donation chains; fingerprint open ports such as 22 or 80 with nmap -sV or nc before trusting the banner.

Boundaries

Use forensics skills when local files or packets need carving, web exploitation skills for active HTTP attacks, and malware skills when suspicious binaries appear. OSINT results can be affected by rate limits, privacy settings, mirror errors, and duplicate usernames, so keep raw output and corroborate important evidence across multiple sources.