0xfun CTF 2026 — OSINT writeup

My writeups for OSINT challenges from 0xfun CTF and by the way it was too much fun.

I focused on Open-Source Intelligence (OSINT) challenges I have tried to solve six of those challenges was really interesting and I was too close but I solved only three of them Where’s Franklin? , Temptation. Stone. Silence. and MultiVerse.

Challenge 1:

Challenge Overview

I began with the provided username Massive-Equipment393 to perform broad reconnaissance, I used Sherlock for automated username enumeration across multiple platforms:

This revealed accounts on Reddit, Spotify and several secondary platforms

The most relevant pivot was the Reddit account.

Inside a Reddit comment, I found 49Rak48kGp7nJoUq9ofCX the character set suggested Base58 encoding (no 0, O, I, l ambiguity). Using CyberChef → From Base58, I decoded it to pl4yl1st_3xt3nd.

This clearly looked like a flag fragment. At this stage, I suspected more encoded data exists and Spotify might contain the next pivot.

The Reddit profile linked to a Spotify account Ph0n8xV1me

I have found 3 Public playlists One playlist description contained MHhmdW57c3AwdDFmeV8= the padding (=) strongly indicated Base64 encoding.

After decoding this Base64 text I got 0xfun{sp0t1fy

Now we have: 0xfun{sp0t1fy_pl4yl1st3xt3nd the final segment was missing. I try to find some hints in My Playlist#1 I found nothing so I moved to My Playlist#2

This is the playlist link if it match you music genre https://open.spotify.com/playlist/4L7oFTFyFDzYguVT1gMJYQ

Initially I tried genre profiling tools (Chosic) to determine favorite genre but it did not provide meaningful challenge-related data.

I switched methodology instead of analyzing genre directly, I analyzed structural patterns in the playlist.

I checked again the playlist and here is it the first character of each song I Concatenating them together

• _WORLD → _
• Maui Wowie → M
• 0801 → 0
• Riptide → R
• 3 Strikes → 3
• _WORLD → _
• Takedown → T
• Rock That Body → R
• 4 Raws → 4
• X Gon' Give It To Ya → X
• {} → }

and i finally got _m0r3_tr4x} this completed the flag.

Flag

0xfun{sp0t1fy_pl4yl1st_3xt3nd_m0r3_tr4x}

Lessons Learned

This challenge reinforced the importance of pivoting across platforms when working with a single username, as valuable clues are often distributed across different services. It also highlighted how encoding types can be recognized through character patterns, allowing faster identification of Base58 and Base64 without guesswork. When direct analysis methods such as genre profiling did not yield results, shifting to structural analysis proved critical. Hidden messages are frequently embedded in ordering, formatting, or acrostic patterns rather than obvious metadata. Ultimately, this exercise demonstrated that OSINT is not merely about collecting information, but about recognizing behavioral patterns, correlations, and subtle design choices that reveal the intended message.

Challenge 2:

Challenge Overview

My task was to identify the exact street name from the provided in-game image.

Provided GTA V in-game image showing a T-junction with STOP marking and mountainous terrain used for geolocation analysis

The image clearly shows selfie UI grid overlay and the “Action: Chest bump” prompt

These elements confirm the location is within Grand Theft Auto V (GTA V) and the character in the selfie is Franklin Clinton.

The surrounding environment shows mountainous terrain, green hills rather than desert, a T-junction with “STOP” painted on the asphalt, a curved hillside road and no urban structures.

This rules out Blaine County desert areas and coastal highways, narrowing it to Los Santos County hill regions.

I did some search for the hills and mountains in GTA to narrow the region

Visual comparison of Vinewood/Tongva hill terrain confirming similarity in elevation, curvature, and vegetation

Visual comparison with GTA Wiki location categories led to Tongva Hills and Vinewood Hills.

The terrain and road curvature strongly resemble Vinewood/Tongva elevated hillside roads rather than canyon or desert routes.

I checked GTA wiki and checked streets and areas

https://gta.fandom.com/wiki/Category:Locations_in_GTA_Online_in_Los_Santos_County

Reviewing the GTA Wiki page for Tongva Drive to compare road structure, elevation, and regional placement within Los Santos County

I reviewed Los Santos County to get more information

Analyzing Los Santos County terrain distribution to confirm the hillside environment aligns with the Marlowe/Vinewood hill region rather than canyon or desert zones

Browsing GTA Wiki’s “Locations in Los Santos County” to narrow the search area based on terrain characteristics

Identified “Marlowe Drive Overlook” in Vinewood Hills, matching the elevated mountain road layout seen in the selfie

While reviewing GTA Wiki location pages under Los Santos County, the page for Marlowe Drive Overlook stood out.

Key matching indicators:

• Located in Vinewood Hills
• Curved mountain road
• Elevated scenic viewpoint
• Terrain formation identical to the rock wall and slope in the screenshot

The wiki confirms location: Marlowe Drive, Vinewood Hills, Los Santos County. This matches the environmental structure seen in the challenge image. Since the overlook is located directly on Marlowe Drive, the required street name for the flag.

Flag

0xfun{Marlowe_Drive}

Lessons Learned

This challenge emphasized the importance of structured visual analysis in OSINT investigations. Instead of relying on assumptions, breaking down environmental elements such as terrain type, road structure, elevation, and signage allowed for systematic narrowing of possible locations. Cross-referencing in-game geography with reliable documentation sources, like GTA Wiki, reinforced how open-source references can validate hypotheses efficiently. It also highlighted that accurate identification often requires comparing subtle landscape details rather than obvious landmarks. Ultimately, the exercise demonstrated that effective geolocation

even in virtual environments depends on observation precision, elimination methodology, and disciplined source verification.

Challenge 3:

Challenge Overview

We were given three images with a poetic hint “Temptation… Stone… Silence of a legend…”our golden rule “Latvian spelling and diacritics required”

Instead of treating the riddle as a guessing game, I approached it structurally: extract visual signals, translate symbolism into searchable attributes, pivot linguistically when needed, correlate folklore and geography and validate with primary Latvian sources

Image 1 Visual Clue: a large golden pig statue placed in a landscaped area.

Object Identification the statue clearly resembles apiggy bank and old-colored (symbol of wealth / greed / temptation)

The challenge says “Something made to catch the eye and test what people choose to value.”This suggests wealth, money, greed and prosperity symbolism

Instead of searching the full riddle text, I broke it down into object + location:

Search pivot: golden pig statue Latvia

I found the image image and results led to a known statue of golden pig made from foam plastic — Malpils Latvia Baltic states but I need to validate this using yandex

Golden Pig Statue

I found this blog in yandex and it validated that in malpils this statue is found. This confirmed City1 = Mālpils

Image 2 Visual Clue : a carved stone monument with a portrait relief of a man.

Challenge hint “A name important enough to be carved and left behind when everything else moves on.”

This suggests a cultural figure, possibly a writer / poet and memorial stone in nature.

I extracted semantic meaning and used search queries as Latvian writer stone monument forest One recurring result: Rūdolfs Blaumanis He is a major Latvian literary figure.

My next step was to verify burial or memorial location.

Stone Portrait Monument

Image comparison confirmed the carved portrait matched.

I examained the blogs I found and this revealed burial and memorial site is located in Ērgļi.

This confirmed City2 = Ērgļi

Image 3 Visual Clue : a quiet forested area with stones.

Challenge hint “They say the region’s elder once made a deal with the devil…”

This suggests a folklore, devil-related legend, rural Latvian village and possibly archaeological or mythological site this required a different OSINT approach.

Instead of full sentences, I used keyword clustering:

Velna Latvija Velna laiva Latvian devil folklore region Latvia legend elder deal with devil

This produced multiple devil-associated monuments across Latvia.

Let’s get back to the given image in the challenge that shows rural environment, natural stone structure, no urban elements and archaeological feel. One result matched both folklore and physical structure: Bīlavu Velna laiva(Devil’s Boat of Bīlava)

This site:

• Is an ancient Scandinavian burial structure
• Surrounded by folklore
• Fits the forested environment

Final search:

located in Lubes pagasts, Talsi municipality.

Location Validation Source

Result located in Lubes pagasts

Thus City3 = Lube

Flag

0xfun{Mālpils_Ērgļi_Lube}

How I Thought Through It

What made this challenge interesting was that:

• Image 1 required symbolic interpretation.
• Image 2 required cultural figure recognition.
• Image 3 required linguistic pivoting and folklore filtering.

Instead of searching full sentences from the riddle, I:

• Broke each line into semantic anchors
• Converted symbolism into searchable entities
• Used Latvian-language pivots when English queries were too broad
• Cross-validated every finding with location data

This prevented false positives.

Lessons Learned

This challenge reminded me that OSINT is a structured thinking process, not intuition. Poetic clues become solvable once symbolism is translated into concrete search terms. Native-language pivoting often unlocks results that English queries miss, especially in folklore-based investigations. Environmental context helps eliminate false leads quickly, and validating administrative hierarchy prevents technical mistakes in final answers. Most importantly, every hypothesis must be tested against multiple sources OSINT is not guessing, it is disciplined elimination and verification.

Final Thoughts

Across these three challenges, one principle stayed constant: methodology beats guessing.

In Challenge 1, pivoting across platforms and recognizing encoding patterns turned scattered clues into a structured solve. When genre analysis failed, shifting to structural pattern analysis revealed the hidden message.

In Challenge 2, disciplined visual breakdown terrain, elevation, road layout allowed precise geolocation inside a virtual world. Careful comparison and source validation were key.

In Challenge 3, symbolic interpretation combined with linguistic pivoting transformed poetic clues into searchable entities. Native-language research and cross-verification prevented false positives.

Overall, these challenges reinforced that OSINT is not about intuition it’s about controlled hypothesis building, structured pivots, and verification at every step.

Thank You For Your Time Wishing This Is Helpful :)