Stuck In The Middle With You

Platform: scarlet | Category: OSINT | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-09 | Status: Solved Techniques: tor_relay_enumeration, onionoo_api, effective_family_analysis

Summary

Category: OSINT Difficulty: Medium Flag format: RUSEC{...}

Stuck In The Middle With You — Scarlet CTF

Description

Category: OSINT Difficulty: Medium Flag format: RUSEC{...}

We're trying to figure out how to track this Tor traffic but all we've got is this string, A68097FE97D3065B1A6F4CE7187D753F8B8513F5! We don't know what to do with it. We're looking for someone responsible for hosting multiple nodes. Can you find the IPv4 addresses this node and any of its effective family members?

Participants are given a 40-character hex string — a Tor relay fingerprint. The task is to identify the IPv4 addresses of this node and all related nodes from its effective family. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Analysis

Data Type Identification

The given string A68097FE97D3065B1A6F4CE7187D753F8B8513F5 represents:

• 40 characters in hex format (0-9, A-F)
• This is the classic format of a Tor relay fingerprint
• The fingerprint is formed as a SHA-1 hash of the relay's public key

Research Tools

For analyzing Tor relays, Onionoo is used — a public API from the Tor Project:

• URL: https://onionoo.torproject.org
• Documentation: https://onionoo.torproject.org/protocol.html
• Allows searching relays by fingerprint and obtaining detailed information ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Finding the Relay by Fingerprint

Using the /details endpoint with the fingerprint parameter:

 bash read-only • copy allowed Copy
curl "https://onionoo.torproject.org/details?fingerprint=A68097FE97D3065B1A6F4CE7187D753F8B8513F5"

Response:

 json read-only • copy allowed Copy
{
  "relays": [
    {
      "nickname": "olabobamanmu",
      "fingerprint": "A68097FE97D3065B1A6F4CE7187D753F8B8513F5",
      "or_addresses": ["REDACTED443"],
      "first_seen": "2020-04-03 06:46:28",
      "last_seen": "2025-01-09 05:57:34",
      "flags": ["Fast", "Guard", "HSDir", "Named", "Running", "Stable", "V2Dir", "Valid"],
      "effective_family": [
        "$B4CAFD9CBFB34EC5DAAC146920DC7DFAFE91EA20",
        "$414E64BA607560F9D9C196A825950DC968700420"
      ],
      "contact": "giannoug@gmail.com"
    }
  ]
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Found:

• Nickname: olabobamanmu
• IPv4: 51.15.40.38
• First seen: 2020-04-03
• Effective family: 2 additional relays

Step 2: Investigating the Effective Family

The effective family contains fingerprints of related relays. Each one needs to be investigated:

Family Member 1: B4CAFD9CBFB34EC5DAAC146920DC7DFAFE91EA20

 bash read-only • copy allowed Copy
curl "https://onionoo.torproject.org/details?fingerprint=B4CAFD9CBFB34EC5DAAC146920DC7DFAFE91EA20"

Result:

 json read-only • copy allowed Copy
{
  "relays": [{
    "nickname": "netimanmu",
    "fingerprint": "B4CAFD9CBFB34EC5DAAC146920DC7DFAFE91EA20",
    "or_addresses": ["REDACTED443"],
    "first_seen": "2019-02-18 17:16:31",
    "flags": ["Fast", "Guard", "HSDir", "Named", "Running", "Stable", "V2Dir", "Valid"]
  }]
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

• Nickname: netimanmu
• IPv4: REDACTED
• First seen: 2019-02-18

Family Member 2: 414E64BA607560F9D9C196A825950DC968700420

 bash read-only • copy allowed Copy
curl "https://onionoo.torproject.org/details?fingerprint=414E64BA607560F9D9C196A825950DC968700420"

Result:

 json read-only • copy allowed Copy
{
  "relays": [{
    "nickname": "kanemeadminmanmu",
    "fingerprint": "414E64BA607560F9D9C196A825950DC968700420",
    "or_addresses": ["REDACTED:443"],
    "first_seen": "2024-12-29 22:28:14",
    "flags": ["Fast", "Guard", "Named", "Running", "Stable", "Valid"]
  }]
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

• Nickname: kanemeadminmanmu
• IPv4: REDACTED
• First seen: 2024-12-29

Step 3: Forming the Answer

Analyzing the flag format requirements. Sorting by first_seen (oldest to newest):

Format: RUSEC{ip1:ip2:ip3}

RUSEC{REDACTED}

Additional Information

Infrastructure

All three nodes are hosted on Scaleway (AS12876):

Contact Information

• Email: giannoug@gmail.com
• Present in the contact data of the main relay

Relay Characteristics

All three nodes have similar flags:

• Fast: High throughput
• Guard: Can be entry nodes
• HSDir: Hidden service directory support
• Running: Currently active
• Stable: Stable connection ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Tools and Resources