Challenge

Date: 06/01/2025

Link: https://ctf-osint.aege.fr/challenges#Portrait robot-70

Welcome to my first writeup!

The LAB'OSINT platform was created by the OSINT & Monitoring club of AEGE. AEGE is a leading network of economic intelligence experts. It's made up of alumni from the École de Guerre Économique (School of Economic Warfare).

The goal of this OSINT training platform is to let everyone discover, deepen or perfect their OSINT skills.

For this GEOINT challenge, our mission is to find the name of the metro station where a poster was put up.

Methodology

This image is very popular in internet culture. I directly recognize the image titled "Ever Dream This Man?"

We can verify this with a simple reverse image search:

Since I already know this false information that was spread worldwide, I remember that posters had been put up everywhere across the world.

We can easily confirm this by visiting the site shown on the poster: www.thisman.org

I then notice the link to the "in the world" page

We then find many photos of places around the world with this same face, translated into several languages.

Only one image directly mentions Barcelona, so let's take a closer look

My method for GEOINT is to spot the important elements in the image:

• Here, this is likely the entrance of the metro station:

• And there, the name of a shop:

• Then, a company logo:

• And finally a street (judging by the bus):

I decide to sum up the clues found, in order to then guide my searches efficiently:

• A shop name
• A metro station
• A logo

I start by searching "el periodico barcelona" on Google Maps:

Many results are shown, but Google Maps can hide some businesses. If the business is closed, for example, it might not be listed on Google Maps.

Since the results from Google Maps aren't precise enough, I then turn to the company logo on the left of the image:

A reverse image search didn't let me find the name of this company:

Since the logo looks similar to the Euro symbol €, we can assume it's a bank, but since I'm not certain, I set this lead aside.

For the next step, I decide to use a very useful GEOINT tool: https://overpass-turbo.eu/

Thanks to the statement, I know the metro station is very close to the El Periodico newsstand. So we can use the following query

I used this script to automate the search:

[out:json][timeout:25];
// We define the search area (Barcelona by default)
{{geocodeArea:Barcelona}}->.searchArea;

(
// 1. We find all metro stations/entrances
node["railway"="station"]["station"="subway"](area.searchArea);
node["railway"="halt"]["station"="subway"](area.searchArea);
node["railway"="subway_entrance"](area.searchArea);
)->.metros;

(
// 2. We look for kiosks or newsagents
//    around the metro stations (10m radius)
node(around.metros:10)["shop"~"newsagent|kiosk"];
way(around.metros:10)["shop"~"newsagent|kiosk"];
);

// Display results
out body;
>;
out skel qt;

We get:

the API returns 10 results.

I then look at the 10 results; to do this, I spot key elements around the points and then search for them on Google Maps.

To avoid writing a writeup that's too tedious, I'll skip straight to the useful information for solving this challenge, but I spent a few minutes performing the same actions that follow for the various points of interest returned by the API.

So I take a look at one point of interest (red circle at the bottom of the image):

Around the kiosk, we find a bank, restaurants and hotels.

I decide to note down these two elements: "Ronda de la Universitat" and the hotel "Hotel Ginebra".

I search for this hotel on Google Maps:

I'm starting to recognize the layout of the image from the thisman.org site; to confirm my hypothesis, I switch to street view mode, position myself at Inkoova Digital Solutions SL, and get this view:

image found on the thisman.org site:

It's the exact same street!

To get the name of the metro station, we keep exploring street view:

We get plaça de ... and Catalunya, as well as line numbers.

A Google search will let us get the full name

The name of the station is therefore Plaça de Catalunya.

However, the flag format requires lowercase text, in French.

Flag

The flag has to be submitted in French (a quirk of this particular challenge's format) — with my rusty high-school Spanish, I can translate it without too much trouble:

Thanks for reading this writeup! I hope it was clear enough.