- Published on
TexSaw 2026 - Osint challenges
Introduction
Between March 27-29, 2026, another American CTF took place on CTFtime. American CTFs are usually interesting with cool challenges. This time was no exception. Unfortunately, the CTF was delayed (CTFtime info was off by 4–5 hours). At least the countdown on the website helped. To make matters worse, Discord was blocked, so organizers set up IRC that almost nobody could access anyway. As for the tasks, I won't complain, but sometimes they worked, sometimes they didn't. When millions of bots rushed in at the start, it was hard to do anything, but things eventually sorted themselves out. As for OSINT, I don't particularly enjoy it because it takes a lot of time and coordinates don't always match, but I thought I'd give it a try and use AI to help. AI was helpful and not, but you'll read more about that later. We solved 4 out of 5 tasks.
You snoze You loze
Solution author: JohnDoers
Description
This was a straightforward task. The exiftool output contains considerable data, and the filename itself served as a hint.
Solution
exiftool 20260124_221412.jpg
ExifTool Version Number : 12.76
File Name : 20260124_221412.jpg
Directory : .
File Size : 8.1 MB
File Modification Date/Time : 2026:01:25 04:14:14+01:00
File Access Date/Time : 2026:03:29 23:31:30+02:00
File Inode Change Date/Time : 2026:03:29 23:31:12+02:00
File Permissions : -rwxrwxrwx
File Type : JPEG
File Type Extension : jpg
MIME Type : image/jpeg
Exif Byte Order : Little-endian (Intel, II)
Make : samsung
Camera Model Name : Galaxy S24 Ultra
Orientation : Horizontal (normal)
X Resolution : 72
Y Resolution : 72
Resolution Unit : inches
Software : S928USQS4CZA1
Modify Date : 2026:01:24 22:14:12
Y Cb Cr Positioning : Centered
Exposure Time : 1/30
F Number : 2.4
Exposure Program : Program AE
ISO : 320
Exif Version : 0220
Date/Time Original : 2026:01:24 22:14:12
Create Date : 2026:01:24 22:14:12
Offset Time : -05:00
Offset Time Original : -05:00
Shutter Speed Value : 1
Aperture Value : 2.4
Exposure Compensation : -2
Max Aperture Value : 2.4
Metering Mode : Spot
Flash : No Flash
Focal Length : 7.9 mm
Sub Sec Time : 464
Sub Sec Time Original : 464
Sub Sec Time Digitized : 464
Flashpix Version : 0100
Color Space : Uncalibrated
Exif Image Width : 4000
Exif Image Height : 3000
Exposure Mode : Auto
White Balance : Auto
Digital Zoom Ratio : 3
Focal Length In 35mm Format : 69 mm
Scene Capture Type : Standard
Image Unique ID : H12XSQE01PM
GPS Latitude Ref : North
GPS Longitude Ref : West
GPS Altitude Ref : Below Sea Level
Compression : JPEG (old-style)
Thumbnail Offset : 996
Thumbnail Length : 44645
Profile CMM Type :
Profile Version : 4.3.0
Profile Class : Display Device Profile
Color Space Data : RGB
Profile Connection Space : XYZ
Profile Date Time : 2022:07:01 00:00:00
Profile File Signature : acsp
Primary Platform : Unknown (SEC)
CMM Flags : Not Embedded, Independent
Device Manufacturer : Unknown (SEC)
Device Model :
Device Attributes : Reflective, Glossy, Positive, Color
Rendering Intent : Perceptual
Connection Space Illuminant : 0.9642 1 0.82491
Profile Creator : Unknown (SEC)
Profile ID : 0
Profile Description : DCI-P3 D65 Gamut with sRGB Transfer
Profile Copyright : Copyright (c) 2022 Samsung Electronics Co., Ltd.
Media White Point : 0.9642 1 0.82491
Chromatic Adaptation : 1.04781 0.02289 -0.05013 0.02954 0.99048 -0.01704 -0.00923 0.01505 0.75214
Red Matrix Column : 0.51508 0.24117 -0.00105
Green Matrix Column : 0.29195 0.69223 0.04189
Blue Matrix Column : 0.15718 0.06659 0.78455
Red Tone Reproduction Curve : (Binary data 32 bytes, use -b option to extract)
Green Tone Reproduction Curve : (Binary data 32 bytes, use -b option to extract)
Blue Tone Reproduction Curve : (Binary data 32 bytes, use -b option to extract)
XMP Toolkit : Adobe XMP Core Test.SNAPSHOT
Version : 1.0
Motion Photo : 1
Motion Photo Version : 1
Motion Photo Presentation Timestamp Us: 3177305
Directory Item Semantic : Primary
Directory Item Mime : image/jpeg
Directory Item Length : 36536
Directory Item Padding : 667256
MPF Version : 0100
Number Of Images : 2
MP Image Flags : (none)
MP Image Format : JPEG
MP Image Type : Undefined
MP Image Length : 36536
MP Image Start : 3039356
Dependent Image 1 Entry Number : 0
Dependent Image 2 Entry Number : 0
Image Width : 4000
Image Height : 3000
Encoding Process : Baseline DCT, Huffman coding
Bits Per Sample : 8
Color Components : 3
Y Cb Cr Sub Sampling : YCbCr4:2:0 (2 2)
Embedded Video Type : MotionPhoto_Data
Embedded Video File : (Binary data 4338232 bytes, use -b option to extract)
Time Stamp : 2026:01:25 04:14:12.464+01:00
MCC Data : United States / Guam (310)
Aperture : 2.4
Image Size : 4000x3000
Megapixels : 12.0
Scale Factor To 35 mm Equivalent: 8.7
Shutter Speed : 1/30
Create Date : 2026:01:24 22:14:12.464
Date/Time Original : 2026:01:24 22:14:12.464-05:00
Modify Date : 2026:01:24 22:14:12.464-05:00
Thumbnail Image : (Binary data 44645 bytes, use -b option to extract)
GPS Altitude : 0 m Below Sea Level
GPS Latitude : 29 deg 11' 4.79" N
GPS Longitude : 81 deg 4' 28.43" W
MP Image 2 : (Binary data 36536 bytes, use -b option to extract)
Circle Of Confusion : 0.003 mm
Field Of View : 29.2 deg
Focal Length : 7.9 mm (35 mm equivalent: 69.0 mm)
GPS Position : 29 deg 11' 4.79" N, 81 deg 4' 28.43" W
Hyperfocal Distance : 7.56 m
Light Value : 5.8
The photo timestamp is 2026-01-24 22:14:12, which matches the Rolex 24 At Daytona race event. By analyzing the GPS coordinates and exif data:
- GPS Position: 29°11'4.79"N, 81°4'28.43"W (Daytona International Speedway)
- Timestamp: 2026-01-24 22:14:12 EST
- Event: Rolex 24 At Daytona
Cross-referencing the timestamp with live race data from imsa.results.alkamelcloud.com for the Rolex 24 At Daytona on 2026-01-24 at 22:14:12 EST, we can determine the two leading cars in the race.
At this specific point in the race (approximately 4 hours and 14 minutes into the 24-hour endurance race), the two leading prototype vehicles were running in formation, with their car numbers being the key to the solution.
The filename 20260124_221412.jpg encodes the date and time, confirming the exact moment in the race standings.
Flag:
texsaw{6_7}
Summer trip
Solution author: kerszi
Description
As I mentioned earlier, OSINT challenges are quite difficult and time-consuming for me, but I decided to try using Gemini Deep Research. I uploaded the image and the task description, and the model told me to go away and come back later. It found some restaurants and ATMs, but since I do not know Japanese, I had trouble navigating Google Maps and identifying places in Japan. I was mostly working blindly. Gemini suggested three locations, but none of them were correct. I decided to come back and take another look, because the description mentioned currency exchange. I found a place that seemed to match, and since I do not know Japanese, I took a screenshot from Google Maps. Gemini confirmed that it was probably the right place. Then I kept submitting those coordinates until it finally worked. The final solution is described below.
Step 1: Decoding the Initial Text and Image Clues The challenge provided a photograph of an Edo-period police poster that says "Stop terrorism!", along with a link to a Japanese blog. The blog post confirmed the existence of this specific Tokyo Metropolitan Police anti-terrorism campaign, detailing a humorous anecdote where the author misread the Japanese word "Tero" (terrorism) as "Ero". The prompt also mentioned the word "Ohno" and a "popular roast beef restaurant." Searching these terms points directly to the highly popular Japanese restaurant chain, Roast Beef Ohno. Lastly, the "yellow money exchange machine" refers to the bright yellow Smart Exchange kiosks, which are widely deployed in tourist-heavy areas in Japan to help travelers convert currency.
Step 2: Eliminating Incorrect Locations Roast Beef Ohno has several highly trafficked branches in Tokyo, including Akihabara, Harajuku, and Ikebukuro. Our first calculation targeted the Akihabara branch, but as shown in the second image you provided (the red "Incorrect" screenshot), that flag was rejected by the CTF platform. This meant the target had to be one of the other branches.
Step 3: Visual Confirmation via Street View We then moved our search to the Harajuku area. The third image you provided showed a Google Maps context menu with a pin dropped at the coordinates 35.67009, 139.70619.
Dropping into Google Street View at this exact location (as shown in your fourth image) provided the definitive visual proof. The Street View image perfectly captured the entrance to the Roast Beef Ohno Harajuku Takeshita Exit branch (located in the basement, indicated by the red "B1" sign). Crucially, directly to the left of the stairwell entrance stands a freestanding, bright yellow "Smart Exchange" machine. This perfectly aligned all the required elements: the specific restaurant, the yellow machine, and a street-level queue area where a tourist would stand and photograph a police poster.
Google Maps (Street View, Harajuku):
1-chōme-8-8 Jingūmae, Shibuya, Tokyo
Flag
texsaw{35_40_11N-139_42_22E}
Just a tree
Solution author: kerszi
Description
Encouraged by the success of finding the Japanese restaurant, I decided to continue with OSINT. This time the task was to find a tree and its coordinates. I had trouble identifying the species, but that was because I didn't read the task carefully enough. I was looking for the largest tree, while the task said the tree was the tall one in the center — I only noticed that after the fact 😉 But let's start from the beginning.
As usual, I uploaded the image to Gemini to help me out. It only told me that it was a campus somewhere in the US and suggested a few options. Then it occurred to me that the photo might have been taken locally — by the CTF organizers in Dallas, Texas. I guessed it was The University of Texas at Dallas campus and decided to go with that. I put AI aside and started browsing the entire campus in Google Earth.
The key landmark I was looking for was a tower covered in antennas. I even found a page about it. It looked very similar to what was in the photo. While exploring the campus in Google Earth, I located the tower and then identified the spot from which the photo was taken:
Similar, right? I then zoomed in on the path, jumped into Google Street View, and found exactly what I was looking for:
You can see it here: The University of Texas at Dallas (Street View)
The next step was to find the coordinates of the tree and identify its species. The coordinates weren't difficult to obtain, but I made a mistake by asking the AI to identify the largest tree instead of the middle one. Gemini insisted it was a cedar_elm — and sometimes pecan — but nothing matched the flag format. I thought: maybe a university like this has a tree inventory? And indeed it does! I found this link online. I browsed through the trees and found a cedar_elm at that location, but right next to it was an american_elm — and that one matched the flag. That was nice and cool task.
Flag
texsaw{american_elm@(32.991,-96.748)}
Snapshot street
Solution author: JohnDoers
Description
This task wasn't easy; we solved it as all team, not only single. In the end, only 25 teams solved it. Every detail mattered. Important information from the task was that it's a continent and a country. We wandered through Australia. After a while, the organizers provided a hint that the flag could be in the format texsaw{streetname_st} or texsaw{drivename_dr}.
Solution
Multiple attempts were made before finding the correct flag:
texsaw{silversands_dr}texsaw{silver_sands_dr}texsaw{ashburner_st}texsaw{moseley_st}texsaw{sunset_strip}texsaw{snapshot_st}texsaw{screenshot_st}texsaw{carnarvon_st}
However, the breakthrough came when Grzechu noticed that the major fast-food restaurant name contained the character ᗰ from McDonald's. John Doers found restaurants with McDonald's in that area. Looks identical, right? I rotated it a bit to show the difference, but if you click the link, you'll see that it's the same screenshot from Google Street View and not taken manually with a camera. 
However, the flag still didn't match. John re-read the task and understood what the challenge author meant. 
It was Salonika St.
Flag
texsaw{salonika_st}
Summary
Although I'm not particularly fond of OSINT challenges, I quite enjoyed these ones.