CTF Open-Source Intelligence (OSINT)
In-Depth Reference
The following reference materialsLoad on demand, select the corresponding file according to the specific direction identified:
Classification Decision Tree
OSINT 题目？
├─ 找人/找账号
│ ├─ 用户名 → whatsmyname.app / namechk.com (741+ 站点)
│ ├─ Twitter/X → 数字 User ID 持久追踪 / Snowflake 时间戳
│ ├─ Tumblr → curl -sI 检查 x-tumblr-user / avatar/512
│ └─ BlueSky → public.api.bsky.app (无需认证)
├─ 找位置（地理定位）
│ ├─ 图片 → Google Lens 裁剪搜索 / Yandex(人脸) / TinEye
│ ├─ 路标/铁路 → OpenRailwayMap / OpenInfraMap
│ ├─ MGRS 坐标 → 在线转换器 → Google Maps
│ ├─ Plus Codes → `XXXX+XXX` 格式 → Google Maps
│ └─ 街景匹配 → 特征提取 + 多指标相似度排序
├─ 找信息
│ ├─ DNS → dig TXT/CNAME/MX / zone transfer
│ ├─ Google Dorking → site: filetype: intitle:
│ ├─ Wayback Machine → 历史快照
│ ├─ WHOIS → 反向WHOIS / 历史WHOIS / IP/ASN
│ └─ GitHub → issue/PR/commit/wiki 分析
└─ 特殊场景
├─ Tor 中继 → metrics.torproject.org 指纹查询
├─ FEC 政治捐款 → FEC.gov
└─ Unicode 同形字隐写 → ASCII=0, 同形字=1
Quick Commands
# 元数据提取
exiftool image.jpg
pdfinfo document.pdf
# DNS 侦察
dig -t txt domain.com
dig axfr @ns.domain.com domain.com
# IP 地理定位
curl "http://ip-api.com/json/IP_ADDR"
# Google Dorking
# site:example.com filetype:pdf
# intitle:"index of" password
# Flag 搜索
grep -rniE '(flag|ctf)\{' .
String Identification
| Format |
Type |
| 40 hex chars |
SHA-1 (Tor fingerprint) |
| 64 hex chars |
SHA-256 |
| 32 hex chars |
MD5 |
Common Tools
| Tool |
Purpose |
| Shodan |
Internet-connected device search |
| Censys |
Certificate and host search |
| VirusTotal |
File/URL reputation |
| Wayback Machine |
Historical web snapshots |
| whatsmyname.app |
Cross-platform username enumeration |
| Google Lens |
Crop region reverse image search |
Google Dorking
- Check robots.txt, sitemap, .git and other information leak sources
