STORY DRIVEN OSINT CTF

easy
medium
hard
insane

The Spy Who Vanished

Briefing

Greetings, Special Agent.

We have received information regarding the long lost spy from MI5, Deloris Frozenwood. She went missing in action a few years ago, never to be seen again. From what we understand, she went on to provide services to whoever the highest bidder might be.

Before she went rogue, Deloris was a revered operative within MI5. Taking on some of the most dangerous assignments and quickly working her way through the ranks. Discontent with management, she took matters into her own hands. Often skirting the lines between rule of law and criminal behavior. She was eventually terminated from MI5.

What happened after her career at MI5 remains shrouded in mystery. She showed up on the radar several times, but only for very brief moments. Having become a target of the organization she once worked for, she’s even gotten arrogant. Often making deliberate appearances for a brief moment, before vanishing to the shadows once again. Our colleagues at MI5 have asked us to obtain any information on Deloris Frozenwood we can find. They’re particularly interested in social media profiles. For reference, Deloris often appears as “Deloris Frozenwood”, or as “D Frozenwood”.

As always, Special Agent, the contract is yours, if you choose to accept.

Materials

Find the spy, find the answer, she’s out there…

Answer Instruction

Use the answer to unlock the flagfile, this will reward you with your badge.

You will know it when you see it, there will be no doubt.

Flagfile

Be advised, the flagfile is an encrypted ZIP. Make sure your OS supports the ZIP format. Ensure the password contains no hidden characters or formatting, paste in Notepad first if the password doesn’t seem to work.

Download Flagfile here

PS: Don’t forget to claim your Coins and XP, by posting your card in the #card-brag channel in Discord.

Official Write-up

Provided here is the official write-up, it does contain the answer. Use this if you’re stuck, or want to verify if you got the answer correct.

The Spy Who Vanished

The challenge involves tracking down a deleted social media profile belonging to Deloris Frozenwood, a former MI5 operative who went rogue. The goal is to find archived information about her Twitter account using web archiving services.

Available Materials

  1. Target name: Deloris Frozenwood (also appears as “D Frozenwood”)
  2. Twitter handle: @DFrozenwood
  3. Background information about her MI5 career
  4. Context about her current activities as a rogue agent

Solution Path

Step 1: Initial Investigation

Gather known information:

  1. Full name: Deloris Frozenwood
  2. Twitter handle: @DFrozenwood
  3. Original Twitter URL: https://twitter.com/DFrozenwood
  4. Context that the account has been deleted

Step 2: Using the Wayback Machine

  1. Visit web.archive.org
  2. Input the Twitter URL: https://twitter.com/DFrozenwood
  3. Look for archived snapshots
  4. Focus on the August 31, 2022 snapshot
  5. Navigate to: https://web.archive.org/web/20220831154130/https://twitter.com/DFrozenwood

Step 3: Password Retrieval

The correct password format will be:

gnf435ynFJEFN#&$_F_D(*FSJ$Fkdfshh5f

Key Points to Remember

  1. The original Twitter account is deleted
  2. Must use web.archive.org
  3. Look for specific snapshot from August 31, 2022
  4. Pay attention to exact password formatting

Common Pitfalls to Avoid

  1. Trying to access the live Twitter profile
  2. Using wrong archival services
  3. Looking at wrong snapshot dates
  4. Incorrect password copying
  5. Missing special characters in password

OSINT Techniques

  1. Use web archives for deleted content
  2. Check multiple snapshot dates if available
  3. Verify account details match the briefing
  4. Document exact URLs and timestamps
  5. Pay attention to profile changes over time

Verification Steps

Confirm:

  1. Correct Twitter handle (@DFrozenwood)
  2. Proper archive timestamp
  3. Profile matches described background
  4. Exact password characters
  5. Special character formatting

Research Methodology

  1. Start with direct Twitter URL
  2. Use Wayback Machine’s calendar view
  3. Look for August 2022 snapshots
  4. Verify profile contents
  5. Document exact password string

Additional Tips

  1. Pay careful attention to special characters in the password
  2. Note the difference between similar-looking characters
  3. Be precise with underscores and asterisks
  4. Verify each character individually
  5. Double-check the entire password string

Remember: The key to this challenge is understanding that deleted social media content can often be found through web archives, and knowing how to navigate the Wayback Machine effectively.

Creator: Frank Diepmaat