← Back to Writeups
CUSTOMMediumOSINT
Bookmark

ExptLocation

XESXOR9/2/20264 min read
#osint#custom#medium#cross_reference_osint#exif_xmp_metadata_analysis#geolocation_by_historical_clue#historical_pseudonym_lookup#linux

ExptLocation

Platform: aclabs | Category: OSINT | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-04-18 | Status: Solved Techniques: cross_reference_osint, exif_xmp_metadata_analysis, geolocation_by_historical_clue, historical_pseudonym_lookup

Summary

Task: two-stage OSINT web challenge — identify a historical alchemist by his Latin pseudonym, then read EXIF metadata of an unlocked image hint and combine both clues to geolocate a German castle. Solution: 'Christianus Democritus' = Johann Konrad Dippel (born at Burg Frankenstein); EXIF XMP of Mary Shelley portrait points to her 1818 novel Frankenstein; intersection gives Burg Frankenstein near Darmstadt.

ExptLocation — aclabs

Description

"Дело о странном эксперименте — Архив паранормальных явлений. В одном таинственном месте проводятся странные и пугающие эксперименты. Алексей Петров должен предотвратить их. Но сначала ему нужно найти координаты этой локации.

Первая подсказка: «Тот, кто называет себя Christianus Democritus снова задумал провести страшный эксперимент. Его суть в том ...»

Введите полное имя того, кто прячется под этим псевдонимом: ****** ****** ******"

English summary: a web-based OSINT challenge hosted on http://10.10.10.10:47483. Two sequential hints must be solved. The first asks for the real name behind the Latin pseudonym "Christianus Democritus". On a correct answer, a second hint (an image) is unlocked, and from the combination of both clues you have to submit the geographical coordinates of the location where the "experiments" take place. The form has rate limiting (~5 attempts per minute). It is the first task of a three-part series: ExptLocation → ExptAccess → ExptDestroy. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Analysis

Hint 1 — the pseudonym

"Christianus Democritus" is a Latinized pen-name historically used by the German alchemist, theologian and physician Johann Konrad Dippel (1673–1734). He lived at and was born in Burg Frankenstein (Frankenstein Castle) near Darmstadt, Hessen, and is one of the candidates frequently cited as a real-life inspiration for Mary Shelley's Doctor Frankenstein.

Pitfall: the name must be transliterated as Konrad (with K), not "Conrad" — the form rejected the latter. The accepted full name is Johann Konrad Dippel. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Hint 2 — the image

After submitting the correct name, the page reveals a second hint pointing to images/hint2.jpg — a portrait of Mary Shelley. Visual identification alone is not enough; the actual prompt is hidden in the image's XMP metadata:

$ exiftool hint2.jpg | grep -i description
Description : The title of a novel written by this author in 1818

Mary Shelley's 1818 novel is Frankenstein; or, The Modern Prometheus.

Combining the hints

  • Person: Johann Konrad Dippel — born at Burg Frankenstein.
  • Novel: Frankenstein (1818) — directly references the same castle/name.
  • Intersection → the castle itself: Burg Frankenstein, Mühltal, near Darmstadt, Hessen, Germany. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The form's coordinate placeholder **.*******, **.******* suggests two two-digit integer parts with seven decimals each, but this is purely visual — the backend also accepts a single-digit longitude (8.xxxxxxx). High precision (7 decimals) is required and the coordinates must point to the actual castle ruins, not a generic Darmstadt area pin.

Solution

  1. Read the first hint on the index page and recognise "Christianus Democritus" as the Latin pseudonym of Johann Konrad Dippel (a quick Wikipedia search on the pseudonym confirms it).

  2. Submit Johann Konrad Dippel (note the K in Konrad) into the name form. The server unlocks the second hint and returns a page referencing images/hint2.jpg.

  3. Download the image and inspect its EXIF/XMP metadata: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

     bash 
    curl -s -b cookies.txt http://10.10.10.10:47483/images/hint2.jpg -o hint2.jpg
exiftool hint2.jpg
# XMP-dc:Description -> "The title of a novel written by this author in 1818"

  4. Identify the portrait as Mary Shelley and the novel as Frankenstein (1818).

  5. Cross-reference Dippel + Frankenstein → Burg Frankenstein (castle ruins near Darmstadt, Germany). Look up the precise coordinates of the castle ruins on a map service.

  6. Submit 49.7932235, 8.6682347 into the coordinates form (mind the rate limiting — ≤5 tries per minute). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Minimal verification script:

 python 
#!/usr/bin/env python3
"""Replay the two-step solution against the challenge web app."""
import requests

BASE = "http://10.10.10.10:47483"
s = requests.Session()

# Step 1: identify the pseudonym
r1 = s.post(f"{BASE}/", data={"name": "Johann Konrad Dippel"})
assert "hint2" in r1.text.lower(), "Name rejected (check Konrad vs Conrad)"

# Step 2: pull the image and read its XMP description (out-of-band: exiftool)
img = s.get(f"{BASE}/images/hint2.jpg").content
open("hint2.jpg", "wb").write(img)
# -> exiftool hint2.jpg => "The title of a novel written by this author in 1818"
# Portrait = Mary Shelley, novel = Frankenstein (1818)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Step 3: Dippel + Frankenstein => Burg Frankenstein near Darmstadt
r2 = s.post(f"{BASE}/", data={"coords": "49.7932235, 8.6682347"})
print(r2.text)  # contains the flag

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍