Operation Broken Shield: A Complete UK OSINT CTF Walkthrough (Phase 1–5)

Portfolio Project | Open Source Intelligence (OSINT) | Digital Investigation | CTF Walkthrough

Operation Broken Shield is a multi-phase Open Source Intelligence (OSINT) Capture The Flag (CTF) challenge designed to simulate a real-world cyber investigation. Throughout the challenge, participants investigate a suspected supply-chain compromise by analyzing digital evidence, tracing aviation assets, retrieving archived technical documentation, and performing geolocation analysis using publicly available information.

Unlike traditional CTFs that focus on a single area of Osint, this challenge combines multiple OSINT disciplines into one investigation. Each phase introduces a different investigative technique, requiring participants to think critically, identify reliable data sources, and validate findings before progressing to the next stage.

I completed this challenge as part of my continuous cybersecurity learning journey and decided to document my investigation process. This article serves two purposes: it showcases my practical OSINT skills as a portfolio project and provides a structured walkthrough for anyone interested in understanding the investigation methodology used throughout the challenge.

Note: This walkthrough focuses on the investigative process and the OSINT techniques used to solve each phase. Some sensitive challenge details and flag values have been intentionally omitted to encourage others to attempt the challenge independently.

Skills Demonstrated

• Open Source Intelligence (OSINT)
• Image Forensics
• Aircraft Intelligence (ADS-B)
• Historical Archive Research
• Aviation Asset Investigation
• Geolocation (GEOINT)
• Google Advanced Search Techniques
• Digital Investigation Methodology

Challenge Phases

Phase 1 — The Initial Compromise

• Recover hidden network credentials from a partially redacted image.

Phase 2 — The Exfiltration Vector

• Identify the military aircraft operating over Toulouse at a specific date and time.

Phase 3 — Legacy Architecture

• Retrieve an archived technical PDF from the Internet Archive.

Phase 4 — The Unannounced Support

• Investigate an aircraft using its ICAO 24-bit address and identify the registered owner’s postcode.

Phase 5 — Ground Intercept

• Geolocate a bus stop from an image and determine the postal code of the surrounding area.

Let’s Begin the Investigation

Phase 1: The Initial Compromise

Challenge Overview

Welcome to NATO Cyber Command. As an open-source intelligence analyst, you are tasked with investigating an active operational security incident. A potential supply-chain vulnerability has been detected, and your team is responsible for piecing together the digital breadcrumbs left across public infrastructure. You must parse raw data, review historical archives, and trace assets across open networks to contain the threat. Good luck.

=========================

A civilian contractor cleaning at an allied facility posted an image to a private online forum to complain about their messy workspace.

Around the same time, network administrators noticed a sharp increase in unusual network activity originating near that specific sector.

The image appears to have been redacted before upload, but we suspect it may still contain the root cause of the anomaly.

Task: Analyse the image to determine if any network credentials were leaked. If so, provide the password of the compromised network.

My Walkthrough

After downloading the provided image, I performed an initial visual inspection. I immediately noticed that part of the image had been covered with a black overlay. Based on this observation, I suspected that the challenge focused on image forensics, where sensitive information may have been visually hidden but not completely removed.

Image given

To verify this assumption, I opened the image in Photopea, a browser-based image editing tool.

Using Image → Adjustments → Brightness, I carefully adjusted the image settings to reduce the effect of the black overlay. As I continued modifying the brightness, hidden information gradually became visible beneath the redaction. After enhancing the image, I successfully recovered the compromised network password hidden beneath the overlay. The recovered value was then submitted in the required flag format, completing the first phase of the challenge.

Hidden password successfully revealed

Phase 2: The Exfiltration Vector

Challenge

Following the network breach, security logs indicate the threat actors targeted a ground telemetry system.

We believe they were attempting to intercept data related to an active allied military flight operating over Toulouse on 13/04/2026 at exactly 11:43 local time in France.

Task: To help us determine what mission data may have been exposed, identify the aircraft that was in the airspace at that exact moment. What was its callsign?

My Walkthrough

After reviewing the challenge, I identified it as an aircraft OSINT investigation. Since the challenge provided a specific location and timestamp, I knew the most reliable approach would be to use a flight-tracking platform that supports historical aircraft data.

I navigated to ADS-B Exchange and accessed its historical flight tracking feature. Using the available filters, I narrowed the search by the specified date, time, and location. To further reduce unrelated results, I enabled the Military Aircraft filter. This allowed me to focus only on military flights operating within the specified airspace during the required timeframe.

After reviewing the filtered results, I identified the aircraft that matched the challenge requirements and retrieved its callsign, which was then submitted in the required flag format

Aircraft information showing the callsign.

Phase 3: Legacy Architecture

Challenge

To understand exactly how the threat actors planned to exploit the ground telemetry system, engineering teams need to analyse the legacy hardware documentation.

The hardware was originally manufactured by Thales-ATM, but the original technical manuals are difficult to locate on the live internet today.

We know a specific validation trial report regarding the “1090 MHz ES Ground station” was previously available on the International Civil Aviation Organization domain (icao.int) sometime during 2005.

Task: Retrieve the historic PDF manual from 2005. What is the exact filename of the PDF document containing these specifications?

My Walkthrough

Based on the challenge description, I recognised that this would require historical archive research rather than a conventional web search.

I started by searching Google using the exact phrase “1090 MHz ES Ground Station” enclosed in quotation marks to narrow the results.

Although Google returned related documents, none matched the required publication year or contained the specific validation report referenced in the challenge. Since the document was no longer available on the live internet, I moved to the Wayback Machine to search archived content.

Within the archive, I searched for the document and filtered the available results to display only PDF files. This led me to the archved technical document published in 2005, from which I obtained the required PDF filename.

Archived PDF showing the filename.

Phase 4: The Unannounced Support

Challenge

Our sensor arrays have detected an active sensor sweep originating from an aircraft operating in the vicinity of the telemetry breach.

Operational command has been slow to update us, and we have received conflicting reports regarding whether this flight was authorised to provide support.

The aircraft is broadcasting an ICAO 24-bit address of 40665B, but our local logs are missing the flight plan and formal assignment details.

Task: Investigate the aircraft associated with this ICAO address and provide the full postcode listed in the registration details of the aircraft owner.

Walkthrough

I began by searching the provided ICAO 24-bit address on Google to determine which aircraft it belonged to.

The search results identified the aircraft and confirmed that it was registered in the United Kingdom, giving me a clear direction for the investigation.

To obtain official registration information, I searched for the UK’s aircraft registration database and located the Civil Aviation Authority (CAA) G-INFO service.

After opening the Advanced Search section, I entered the ICAO 24-bit address into the appropriate search field.

G-INFO Advanced Search page.

The search returned the aircraft’s official registration details, including the owner’s information. From this record, I identified the required postcode and submitted it in the expected format.

Aircraft registration details showing the postcode.

Phase 5: Ground Intercept

Challenge

Verification of the unannounced Thales flight confirms it was a friendly asset performing an automated sensor sweep.

While you were verifying the tracking platform, human intelligence (HUMINT) sources intercepted an operational image transmitted by the threat actor.

Our analysis team initially had very little to go on regarding the image itself, but the friendly aircraft’s onboard array has now alerted us that it detected rogue signal transmissions originating specifically from the southern sector of the Tarn department in France.

We need you to determine where this photograph was taken so ground units can be deployed to secure the physical node.

Task: Analyse the attached image and pinpoint the location of the bus stop shown in the picture and provide the 5-digit postal code of the area.

Image Given

meeting location

My Walkthrough

From the challenge description, I recognised this as a geolocation (GEOINT) investigation.

I began by uploading the provided image to Google Reverse Image Search to identify any visually similar locations.

Google Reverse Image Search results.

The reverse image search suggested that the image was likely taken within a commune in southwestern France. This provided a useful starting point for narrowing the search area.

After reviewing the image more closely, I noticed several visual clues, including a bus stop and a nearby church, which became the primary landmarks for the investigation.

To refine the search, I used FindThatSpot.io and searched for bus stops located within close proximity to churches in the Tarn region. The tool generated several possible locations, each linked to Google Street View.

I examined each suggested location until I found a bus stop whose surroundings matched the original challenge image.

FindThatSpot.io results.

Finally, I opened the confirmed location in Google Maps, where I verified the bus stop and obtained the corresponding five-digit postal code required for the challenge.

Conclusion

Operation Broken Shield was an engaging and practical OSINT challenge that brought together multiple investigative disciplines within a realistic incident-response scenario. Each phase presented a unique problem that required a different research strategy, encouraging critical thinking and structured investigation rather than guesswork.

Documenting this walkthrough has allowed me to reflect on my investigative process while creating a portfolio project that demonstrates my practical OSINT skills. I hope this guide provides useful insight into the techniques used throughout the challenge and serves as a helpful reference for others interested in developing their own investigative methodology.

Thank you for reading, and I encourage you to attempt similar OSINT challenges to continue building practical, hands-on cybersecurity experience.