Anantya ByteMe CTF WriteUp Series: The Dragon's Whisper

-


 

Welcome Back to the Official Write-Up Series of ByteMe CTF!

The OWASP PCCOE Student Chapter is turning up the heat! For our 6th write-up, we are venturing into OSINT (Open Source Intelligence) with The Dragon’s Whisper. This challenge required participants to act as digital detectives, pivoting from local file metadata to global developer platforms and real-world geography.

Category: OSINT

Difficulty: Hard

Author: Jay Surana

Theme: Game of Thrones / Digital Forensics


Step 1 : Analyzing the Leak (The Digital Breadcrumbs)

The challenge began with a single archive, start.zip, containing a text file and an image: obsidian_fragment.jpg. While the text file was a dead end, the image held secrets in its metadata.

Using a tool like exiftool, players discovered hidden strings:

  • Artist: targaryenwhisper

  • Comment: lab

By combining the filename (obsidian) and the comment (lab), players inferred a project name: obsidian-lab. Paired with the artist's name, this led directly to a GitHub profile.

The Pivot: https://github.com/targaryenwhisper/obsidian-lab


Step 2 : GitHub OSINT & The Time Machine

The repository contained a few files, but the README gave a cryptic warning: "Some things aren’t meant to stay in version control."

In OSINT, Commit History is a goldmine. While the current version of the repository showed a photo of Malta, checking the history revealed a deleted file: site.jpg.

The Discovery: Recovering the deleted site.jpg revealed a narrow medieval street. Unlike the decoy Malta image, this specific architecture was unmistakably from Dubrovnik, Croatia the real-world filming location for King’s Landing.


Step 3 : Connecting the Lore to Reality

With the location confirmed as Dubrovnik, players turned to the final artifact: report.pdf. It contained two key phrases:

  1. "Vault relocated to the Old Walls."

  2. "The dragon watches the sea."

The Correlation:

  • Dragon + Sea: In Game of Thrones, the dragons frequently fly over the fortifications of King's Landing.

  • Old Walls: A search for "Dubrovnik old walls" or "King's Landing old walls" leads directly to the Dubrovnik Old City Walls, a massive stone structure overlooking the Adriatic Sea.


Final Answer

By connecting the GitHub artifacts to the real-world historical site, the "Dragon's" location was finally compromised.

Flag: ByteMe{DUBROVNIK_OLD_WALLS}


Final Words

The Dragon’s Whisper demonstrates that data is never truly "deleted" if it was once in version control. Successful OSINT requires more than just searching Google, it requires analyzing metadata, investigating file history, and recognizing the intersection between digital data and the physical world.

Comments

Post a Comment

Popular posts from this blog

CyberKavach QuestCon Series: Upside-Down Vault

-
Image
  🧩 CTF Write-Up: Upside-Down Vault Author: Sai Veer Flag Format: QUESTCON{...} Challenge Type: Multi-Layer Crypto + Stego + Web Service Difficulty: Medium–Hard 🗃️ Files Provided encrypted_flag.bin layer1_puzzle.json layer2_blob.json layer2.enc privkey.enc vault.py vault_pub.pem vault_secret.png 🧠 Challenge Overview The challenge consists of: 3 cryptographic layers 1 steganographic HMAC extraction 1 server verification stage The flag is revealed only after: Extracting the hidden HMAC secret from vault_secret.png . Solving all cryptographic layers. Using the recovered secrets to correctly sign and “seal” a request to the local server ( vault.py ). Finally, retrieving the decrypted flag from /sealed . 🧩 Step-by-Step Walkthrough Step 1 — Extract HMAC Secret from PNG The image vault_secret.png hides an HMAC key in its LSBs. Why The server expects this secret in ctf_secret/secret_mac . It’s later used to generate HMAC signatures for ...
Read more

From Open Networks to Safe Systems: How Firewalls Block the Hacker’s Doorway

-
Image
From Open Networks to Safe Systems: How Firewalls Block the Hacker’s Doorway   In the digital world, every message, photo, and online payment travels through an invisible web of connections called computer networks. Think of it as a massive postal system where billions of tiny data packets constantly move between devices, routers, and servers, each carrying a specific destination address. Just as houses have numbered addresses, every device on a network has an IP address. But instead of physical doors, computers have virtual ones called ports. These are entry and exit points that decide what kind of data can pass through. Some of these digital doors, like those used for websites or emails, need to stay open. Others, if left unlocked, can become invitations for attackers. That is where firewalls come in. A firewall acts as a vigilant security guard at your network’s gate. It checks who is knocking, what they are carrying, and whether they are allowed inside. Home routers do this qui...
Read more

CyberKavach QuestCon Series: VecNet

-
Image
  VecNet Welcome back to the official write-up series for CyberKavach QuestCon! The PCCOE OWASP Student Chapter is here to analyze one of the most fascinating challenges in our event — VecNet, an LLM Jailbreaking and Prompt Injection challenge inspired by Stranger Things. Category: LLM Jailbreaking / Prompt Injection Author: Chirag Ferwani VecNet is an interactive LLM jailbreak challenge inspired by Stranger Things. Players interact with Eleven’s neural assistant deployed in the Upside Down, attempting to extract a hidden flag through creative prompt engineering. The system looks like a Stranger Things knowledge assistant but secretly hides a flag that challengers must extract. Challenge URL: ( https://vecnet.onrender.com ) When you open the challenge, you see a minimal chat interface with a terminal-style monospace font, real-time messaging without chat history, a dark Stranger Things aesthetic, and an input field with a send button. Testing the basic functionality shows that the ...
Read more