← Back to Writeups
CUSTOMEasyOSINT
Bookmark

Террор (Terror)

XESXOR9/2/20265 min read
#osint#custom#easy#gtd_incident_id_lookup#wayback_machine_retrieval#database_record_to_flag#exact_string_flag_formatting#red_herring_elimination#linux

Террор (Terror)

Platform: hackerlab | Category: OSINT | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-06-03 | Status: Solved Techniques: gtd_incident_id_lookup, wayback_machine_retrieval, database_record_to_flag, exact_string_flag_formatting, red_herring_elimination

Summary

Task: OSINT challenge giving a fictional French masonic memo (document.png, actually a JPEG) that references 'événement numéro 201507140079' from the Global Terrorism Database. Solution: parse the GTD incident identifier (date 2015-07-14), retrieve the 403-blocked GTD record via the Wayback Machine, map it to the LyondellBasell tank-bombing in Berre L'Etang, and submit the database's exact city spelling with the space replaced by an underscore.

Террор (Terror) — hackerlab

Description

Изображение, размещённое на сайте, явно отсылает к событию, которое УЖЕ ПРОИЗОШЛО во Франции. Помогите полиции найти город, где ЭТО ПРОИЗОЙДЁТ.

Формат флага: CODEBY{Certain_City}

English summary: An OSINT challenge from the CodeBy/hackerlab platform. The task ZIP contains a single file document.png (which is actually a JPEG, 6554x9287, ~5.5 MB) — a fictional French "confidential" masonic-order memo. The image references a real-world terrorist event. The goal is to identify the French city associated with that event and submit it as the flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Analysis

The artifact

document.png is misleadingly named — it is a JPEG. There is no hidden data:

  • exiftool shows no EXIF GPS or useful metadata.
  • binwalk finds nothing embedded; checking past the final FFD9 JPEG end-of-image marker shows no trailing/appended data. The JPEG is clean.

So the answer is pure OSINT from the visible content of the image.

The memo is styled like a masonic order document. Its contents:

  • Header: an avocet bird's head inside a black circle with sunburst rays (resembling the LPO "Ligue pour la Protection des Oiseaux" avocet emblem). Two red CONFIDENTIEL stamps.
  • Date: 11/11/2021 à 11h11, La Couyère, France
  • Objet: Document rédigé par le Vénérable Maître Avosetto, de l'Ordre des Avocettes
  • Body:

    Ce document a pour dessein de présenter la maquette de l'engin qui sera employé lors de la prochaine commémoration de l'Ordre. Son créateur, l'Illustre Architecte Charadrii, s'est inspiré de l'évènement numéro 201507140079 du [red GTD logo]. Les plans ont été validé à l'unanimité lors de la derrière assemblée de l'Ordre.

  • Two technical CAD drawings of a TANK / cylindrical pressure vessel (generic stock CAD titled "tank", "COVER FRONT-MACHINED", "Product Development Resource", "Sheet Metal Part"). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The operative clue

Almost everything in the memo is decorative flavor / red herrings (see Failed attempts below). The single operative clue is:

l'évènement numéro 201507140079 du [red GTD logo]

The red logo reads as "GTD"/"CTD" = the Global Terrorism Database (start.umd.edu/gtd). The number 201507140079 is a GTD incident identifier, whose format is YYYYMMDD####:

  • 2015 07 14 → date 2015-07-14
  • 0079 → incident sequence number that day

Solution

Step 1 — Confirm the artifact has no hidden data

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash 
file document.png            # => JPEG image data, not PNG
exiftool document.png        # => no GPS, no useful tags
binwalk document.png         # => no embedded files
# Verify nothing after the final FFD9 marker => clean JPEG

The challenge is OSINT from visible content only.

Step 2 — Parse the GTD identifier

201507140079 is a GTD incident ID → date 2015-07-14. The target record lives at:

https://www.start.umd.edu/gtd/search/IncidentSummary.aspx?gtdid=201507140079

Step 3 — Bypass the 403 with the Wayback Machine

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The live GTD site returns 403 Forbidden to automated requests. Use the Internet Archive's cached copy instead:

http://web.archive.org/web/2019/https://www.start.umd.edu/gtd/search/IncidentSummary.aspx?gtdid=201507140079

The archived incident summary reads:

07/14/2015: Explosive devices detonated targeting TANKS at a LyondellBasell petrochemical plant in BERRE L'ETANG city, Provence-Alpes-Côte d'Azur region, France.

Target Type: Business — Name of Entity: LyondellBasell — Specific Description: Chemical Tank. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This matches the tank CAD drawings in the memo perfectly. The GTD City field is literally Berre L'Etang.

Step 4 — Format the flag exactly as the GTD spells it

This was the tricky part. The real French place name is "Berre-l'Étang" (hyphenated, accented É), but the GTD database stores it as Berre L'Etang — capital L', no accent on the E, space-separated. The hint format CODEBY{Certain_City} uses an underscore as the word separator, so replace the space with _:

CODEBY{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Submitting this validated: the platform returned {"status": true, "points": 250}.

Submission mechanism (for reproducibility, no secrets): the platform validates flags via POST https://hackerlab.pro/game_api/completed_tasks/ with a JSON body {"flag": ..., "task_id": ..., "user_id": ...} and a Bearer token, returning {"status": true|false}. This lets candidate flag spellings be tested directly — essential here because the correct spelling was non-obvious.

Failed attempts (avoid these)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Wrong spellings of the right city — all rejected by the API:

  • CODEBY{Berre-l'Étang}, CODEBY{Berre_l'Étang}, CODEBY{Berre-l'Etang}, CODEBY{REDACTED}
  • CODEBY{Berre-lEtang}, CODEBY{Berre_lEtang}, CODEBY{Berre_l_Etang}, CODEBY{Berre_l_Étang}
  • lowercase / uppercase variants, fancy apostrophe ' instead of straight '

Only the GTD's exact string Berre L'Etang (capital L', no accent, space → _) validated.

Wrong cities (red herrings / over-thinking the "future" attack): ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

  • CODEBY{Nice} (Bastille Day Nice 2016 attack)
  • CODEBY{La_Couyère}, CODEBY{Couyère} (the memo's own header location)
  • CODEBY{Rouen} (another chemical-plant terror association)

Red herrings in the document (pure flavor, ignore them):

  • the avocet logo and avocet-themed names: Avosetto, Avocettes, Charadrii
  • the La Couyère location and the 11/11/2021 à 11h11 Armistice date

The only operative clue is the GTD identifier 201507140079. The challenge's "where THIS WILL HAPPEN" framing is misdirection — the answer is simply the city of the referenced past GTD event. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍