Tools · CTF categories for beginners · 22 / 26
Beginner OSINT challenges: a public page is not a person to find
An OSINT practice challenge gives you a public page or a screenshot of one. Quote the URL, the time you saved it, and the sentence it shows. It does not authorize you to contact anyone, visit an address, or look up a private individual.
The page is the artifact
Beginner OSINT tasks on a practice platform hand you something already public: a lab club page, a screenshot, or a caption. The sentence on that artifact is what you can cite. A title, a mascot name, or an opening hour is text. It is not a home, and it is not permission to identify a real person.
If the artifact is a screenshot with no URL, write “URL not on the screenshot.” Do not guess a site and do not browse for a private profile to fill the gap.
Where the practice stops
You do not call the club, visit a street, or search for a person’s home. You do not create an account to see a private group. The challenge is finished by reading the public artifact and checking it against the flag format on the event sheet. If the text does not match that format, it is a clue or a dead end, not a reason to widen the search onto real people.
A fictional club in the bundle is not a directory of residents. Leave it fictional.
What to write down
File the URL or “URL not on the artifact,” the time you saved the page, and the sentence you are using. File the flag format from the event sheet as a separate line. State that you did not contact anyone.
Lab: a club page that names a mascot
The practice page https://club.example/about says “North Pier Club meets on Tuesdays. The mascot is Pennant.” You saved it at 2026-04-02T18:00:00Z. The event sheet says flags look like flag{...}. A draft treats Pennant as a person to look up and suggests visiting the pier.
The note quotes the two sentences, the URL, and the save time. Pennant is a mascot on the page, not a person you search for. Tuesday is an opening line, not an address. Nothing is submitted, because the sentences do not match the flag format. No one is contacted.
url: https://club.example/about
saved: 2026-04-02T18:00:00Z
sentence: The mascot is Pennant.
event format: flag{...}
contact: none
write: the page and the format check
not: a person to find, and not a visitDiagram
The artifact and the search you do not start
The page is the challenge. A person is not.
Cite. URL, save time, and the sentence
Check. Whether the text matches the flag format
Stop. When it does not match
Contact. Do not call or message anyone
A visit. Do not go to a place named in the text
A private person. Do not turn a mascot or a caption into a search
Check yourself
1. A practice page says the mascot is Pennant. What is Pennant in your note?
2. The sentences do not match flag{...}. What do you do next?
3. The screenshot has no URL. What do you write?