Capture the Flag (CTF)

  • Running an InfoSec conference?
  • Want an OSINT component with live targets?
  • Want to provide value back to your local community?

Trace Labs provides an OSINT contest platform that will allow you to successfully train your attendees in OSINT while providing a fun and exciting contest.

Basics:

The contest runs as a Capture the Flag (CTF) format where contestants must collect various “flags” which equate to points. The contestant with the most points wins. The scoring system is below.

Schedule: 

The contest typically runs as a marathon format of 24×7 for 2 days and one night although this can easily be adjusted to fit the length of the conference. Contestants are free to work the contest as much or as little as they prefer. Operational periods for score updates are typically 9am and then 4pm local time, each day.

Platform:

The CTF platform utilizes the Slack application to allow contestants a fast and familiar way to contribute references to online evidence. Contestants can sign up at any time for the Trace Labs Slack environment:

https://tracelabs.slack.com

The Slack channel will be marked: CTF-Conference Name-MP#

Scoring System:

Note: Any item that ends with (s), such as Landlord(s) means you can score points for each one you find.

10 Point – Information on Target’s Friends (Must show relevance. Listing all the friends on their Facebook is not worth points. Showing these details with their best friend is. ) These are easy points.

  • Name(s)
  • Aliase(s)
  • Birth date
  • Any ID #(s) (drivers license, passport, library card, etc)
  • Home address
  • Home phone number
  • Work address
  • Work phone number
  • Email(s)
  • General case info (videos or news that is general)

20 Points – Information on Target’s Employment (max of 3)

  • Name(s) of employer
  • Website(s) of employer
  • Social media handle(s) of employer (Facebook, Twitter, etc)
  • Target’s information(s) on employer site (picture, details, etc)

30 Points – Information on Target’s Immediate Family

  • Name(s)
  • Aliase(s)
  • Birth date
  • Any ID #(s) (drivers license, passport, library card, etc)
  • Home address
  • Home phone number
  • Work address
  • Work phone number
  • Email(s)
  • Social media handle(s) (Facebook, Twitter, etc)
  • Last time they saw the target
  • Any insightful information that might show direction of travel, location or intent from family’s comments.

50 Points – Information on Habitat

  • Landlord(s) name
  • Landlord(s) phone number(s)
  • Recent accommodation(s)
  • Any meaningful interaction with landlord
  • Risks in the immediate area: sex offenders, etc
  • Previous missing persons events for target

100 Points – Any Information on Target

  • Name
  • Aliase(s)
  • Birth date
  • Any ID #(s) (drivers license, passport, library card, etc)
  • Home address
  • Home phone number
  • Work address
  • Work phone number
  • Email(s)
  • Social media handle(s) (Facebook, Twitter, etc)
  • Blog or forum posts
  • Physical description

200 Points – Unique Identifiers of Target

  • Unique identifiers: Tattoo(s), scars, piercings, etc
  • Medical issue(s)
  • Pictures found online
  • Clothing worn on day of disappearance

300 Points – Complex Data On Target

  • Brand of cell phone(s)
  • Model of cell phone(s)
  • Cell phone carrier(s)
  • Make of vehicle(s)
  • Year of vehicle(s)
  • Color of vehicle(s)
  • License plate of vehicle(s)
  • Video game handle(s) (xbox, etc)
  • IP address(s) (external facing gateways)
  • Date site account(s)
  • Regular hangouts (Facebook, Twitter, etc)
  • Date site profiles
  • Online resume
  • Personal blog(s)
  • Personal website(s)
  • Reddit account(s) – or sites of similar nature
  • Evidence of intent or direction of travel of target

500 Points – Day Last Seen

  • Pictures of target on day last seen
  • Details of target on day last seen
  • Person last seen with
  • Intent to meet with someone after day last seen
  • Direction of travel on day last seen
  • Other details that relate to the day last seen that may be relevant (ensure you explain this)

1000 Points – Darkweb Details on Target (do not use a work computer to search this stuff)

  • Picture or details on sites such as backstage
  • Discussion regarding target on Darkweb site(s)

5000 Points – Location

  • New information on location (this does not include a Police update saying the person was found. That gets 50 points.)

NOTE: Any information that can be used to help locate the subject has value. While many items are listed above, there will be many items that are not and will be valued as the CTF progresses. More is better and you will likely get points for items not listed here if it is deemed to help the investigation.