AUCTF - OSINT You All Over the Place

AUCTF - OSINT You All Over the Place

Lyell Read


AUCTF logo

A post-competition writeup; 983 points


I do not have access to the prompt, but the URL is


After solving the first three challenges, I looked into this one. I investigated the website provided thouroughly, and found out the following:

  • Images mcofee.png and mcafee.png are different, their difference contains some data and a discord link (applicable to Oryx, the last OSINT challenge).
  • Loretta Mcintosh (with twitter handle @BackUpOrMcintoshYouOut) and Jorge Greenwood (@JorgeGreenwoodCodes), and two sites listed in Jorge Greenwood’s Bio, all of which are dead ends on Wayback Machine and at the time of writing ( was up for sale, and was a corporate site).
  • dig +short:

This is where I got stuck when working through this challenge. I did not (stupidly) pursue more info about the site itself, or who was responsible for hosting it. I wil next time, you can bet on that ;).

First, we pull the ICANN information about the site resulting in this.

That shows that the site is hosted by namecheap, so let’s pull the namesheet data for that site too, and see if we can get more information about it. I queried and got this.

That reveals the email of the registrant is, so we can infer that their name is Shannon Engrid.

A Google search turns up first result of Shannon’s linkedin profile link archive, which under “Contact Info” lists a twitter link archive, which in turn lists an instagram account link archive

This in turn has a photo on it, which is of some text:

Photo of a computer screen showing the Lorem Ipsum text containing a CTF flag

There is “auctf” and some leetspeak in there, but it is surrounded by (and split up by) the default sample text (“Lorem ipsum dolor sit amet”). We need to remove that, which I did manually (for each word after “auctf”, if it is in the default text, do not count it in the flag) (based on this: