Hackappatoi CTF 2023 is a jeopardy style CTF organized by the Hackappatoi team of La Sapienza University. This CTF has numerous categories such as Web Exploitation, Reverse Engineering, Binary Exploitation, and more. In this writeup, I’ll be explaining the OSINT section challenges.

Why Not? (Naples)

We are given this video and our task is to find the hotel Justin Bieber supposed to be staying in Naples. A quick Google search of "Justin Bieber Napoli Hotel" will give us the answer.

Italian mails (Origins)

We are given this video and the task is to find the street the video was recorded in. In the video, a man is seen standing in front of an Italian postage company known as "Poste Italiane". When we investigate the person in the video online, it appears he is somewhat infamous. Moreover, there's a longer 4-minute version of the video on YouTube, and the description reads: "Here's Enzo the bum from Ostia! :)"

The video ends with another clue, the post office has a staircase and the presence of trees at its entrance.

Now, we can search every post office in Ostia with the specified features. Our search led us to a post office located on "Via Ferdinando Acton" street.

The meninges

We are given another video, where we once again met Enzo. When observing the video, there's two stores that appeared on camera. One of them was labeled as "Sali E Tabbachi Lotto".

After doing a quick Google Maps search, it seems that the store is a tobacco shop with numerous location in Ostia and it would be inefficient to search it one by one. To narrow down our search, we shifted our focus to the next store in the recording.

A quick Google search for the store "Pizzeria Rustica Del Capitano" led us to a pizza store on "Viale della Stella Polare" street in Ostia. And it was the location the video was recorded in.

Telecamere?

The task here is to find the filming location in this video. The challenge was intensified by the presence of unclear signs in the background. Using reverse image search, we discovered valuable information about the location.

Searching it on Google Maps pinpointed the recording location near "Via S. Biagio di Val Polcevera" street in Genoa. Sadly, the challenge remained unsolved because of flag format issues.

Sunkissed Enzo

We were given another video with Enzo in it. The video contained store signs, but sadly it was unreadable because of the low resolution. But, we can use the shadows on the ground as an alternative means of identification.

Analyzing the shadows, the camera was oriented in the west-east direction, with noticeable overexposure due to excessive light. Another unique features in the video is the significant gap behind the building on the left, suggesting the presence of a park or an empty lot. Additionally, there is a basement parking facility as seen in the video.

We then can start searching for this location manually. After a few days of digging, the filming location was on "Via della Tolda" street in Ostia. This challenge was solved after the event has ended, sadly.

That's all for this writeup, thank you for reading.