OSINT, open-source intelligence, is gathering information from publicly available sources such as search engines, social media, archives, maps and file metadata. In a CTF the answer, such as a place name or an account handle, becomes the flag.
Example
A challenge gives one photo and asks which city it was taken in. A shop sign shows a partial name, a tram line number is visible, and shadows suggest the time of day. You search the shop name on a map, confirm the tram route and submit the city. Every step uses only public data about a fictional scenario the organizers prepared.
Method that works
- Write down every clue before searching.
- Check image metadata and reverse image search.
- Use the Wayback Machine for pages that changed.
- Verify each answer with a second source.
Stay in scope. Investigate only the personas, accounts and sites the organizers named. Looking up real private individuals is not a CTF.
On CTF7
OSINT challenges are text and image based, so they run without a lab instance. Organizers can attach files, add tiered hints and set per-flag points. Players can attempt them on Ouroboros CTF or in live events.
Learn more
Read the OSINT guide for worked examples and tools, or browse all CTF guides.
Related terms
Browse the full CTF and cybersecurity glossary for more terms.
