THCon 2025 - OSINT track
This series of OSINT challenges was all based on the same “GeoGuessr” mechanic—we were dropped into a panoramic “StreetView” without the ability to move. Ranging from easy to hard, these challenges taught us to focus on the most important elements of our surroundings to pinpoint our location in space.
Gunnar’s Vacation — Picture 1
50 points (easy)
It looks like Gunnar (a.k.a “The Executioner”) has given his fellow gang members the slip and run off with the money they extorted from THBank!
Luckily, we have some access to The Razor’s infrastructure, and it seems he has glimpses of Gunnar’s cybernetic eyes. The XSS is tracking him, and the website we discovered is likely used to send minions to locate the fugitive under the supervision of a—particularly original—AI named Glad0s.
Our goal is to leverage this platform to find as many pictures as possible of places Gunnar has visited during his trip. This way, we can check CCTV footage and maybe predict his next move.
For your sanity (and copyright reasons), we’ve disabled the music the AI was constantly playing. But if you want the full experience, here it is: https://www.youtube.com/watch?v=FheUboY-9bo
To start, we need to identify the most notable elements—those that can be easily and quickly exploited to give us a reliable result. In this case, the most striking feature is the facade of this hotel:
A quick Google search leads us straight to the “Beau Rivage” hotel in Nice.
We double-check on Google Maps to confirm it’s the same city:
Then, all we have to do is click on the interactive map in the top-right corner to validate the location.
Gunnar’s Vacation — Picture 2
50 points (easy)
What stands out in this view is the peninsula in the background.
The location is immediately identified using Google’s reverse image search.
Given the proximity to the road and an isolated building, we could guess that the photo was taken somewhere around here:
Viewpoints are marked on OpenStreetMap, which is why I used it to identify the rocks matching those in the photo.
THC{Hum4n5_4r3_5l0w}
Gunnar’s Vacation — Picture 3
50 points (medium)
Here, we see a mountain clearly visible on the horizon. Mountains are often excellent landmarks because they change very little over time. Their size and “popularity” mean they appear more frequently in photos and are better documented.
Only two locations are associated with this viewpoint: La-Seyne-sur-Mer and Saint-Mandrier-sur-Mer. These places are side by side near Toulon.
Checking Google StreetView, we notice that Toulon’s port isn’t available because it’s a military zone. So, our port probably isn’t on that side. There’s also no mountain on the Saint-Mandrier-sur-Mer peninsula.
Most importantly, if we have almost the same view from both towns, maybe we should look at the border between them.
Bingo!
Now, we just need to find the exact spot, but we’re already within a few dozen meters.
THC{U_L0s3_Gl4d05_W1nz}
Gunnar’s Vacation — Picture 4
50 points (medium)
As before, the goal is to identify the most distinctive element that can help us locate our position.
I immediately thought of identifying the tram. Only a limited number of cities have one, and they’re usually unique to each city in France. This would let us quickly identify the city and even the line in some cases.
After another reverse image search on Google and some digging, I confirmed that Marseille is the city with these specific trams.
Next, we need to look at the other elements in the photo to see where they’re located in Marseille, especially near a tram line.
Here, we see a Nexity sign next to the number 56.
We could have used this simple Overpass Turbo query to find the only location with the brand “Nexity.”
This is clearly the exact sign we’re looking for—it’s at number 56 on a street with a tram line. There’s no real doubt, but we should always verify.
All the visible elements match the location we’re looking for. Confirmed!
THC{Y0u_Shur3_W3_4re_St1ll_l00king_4_Gunn3r?}
Gunnar’s Vacation — Picture 5
86 points (hard)
Now things get tricky ;)
Here, it wasn’t easy to find standout elements—just the color of the crosswalk, the Spar store, and the feeling that we’re in a bay.
The small “mountain” in the background didn’t help, as it’s probably not notable enough.
Although the vibe suggests the south of France, I found nothing along the Mediterranean coast.
Eventually, I tried identifying the building housing the Spar store—it seemed unusual.
I found similar places in Turkey with matching architecture and mountains, but we need a location where French is spoken (given the “cédez le passage” sign).
Most importantly, the first location detected by Google was in Corsica! My mistake was only searching mainland France.
Next, I needed to find all Spar stores. For this, I used Overpass Turbo again with a simple query to locate Spar stores in Corsica, then checked those near Sartenais-Valinco-Taravo.
We could rule out the ones in Propriano and Sartène, as they didn’t match, leaving us with Olmeto as the correct location.
Alternatively, we could have used Overpass Turbo to filter for stores near a roundabout close to the sea.
THC{M3h_1_Gu355_u_f1nd_stuff_3v3ntu411y}
Gunnar’s Vacation — Picture 6
136 points (hard)
🩸 First Blood*
(*First team to find the flag.)
This challenge was definitely the hardest of them all. My only clues were the sign indicating distances to nearby towns/landmarks:
- IS ARUTAS (10.5km)
- ORISTANO (19km)
- PUTZU IDU (19.5km)
Apparently, in Sardinia, road signs show distance, not travel time (unlike France since April 1, 2024).
Other clues included the hill in the background, the paved road, and the sign in the distance suggesting an intersection.
The easiest part was identifying the towns, all located in Sardinia (an Italian island).
I noticed that very few roads in the area were paved, and one of the landmarks (IS ARUTAS) is mostly just a beach name, making it unlikely to appear on a sign.
Triangulation seemed like the best approach.
Looking at the road distance between Putzu Idu and Oristano, it’s about 29km for the longest route, which is also the closest to Is Arutas. This is good because our target location is much closer to Is Arutas than to either town.
The logic was to head southwest until we were about 19km from Oristano and Putzu Idu, landing us near San Giovanni di Sinis.
From there, I traced all possible routes to find the sign or a matching location.
Although I could have found it this way, nothing confirmed the exact spot.
So, I checked alternatives to Google StreetView:
When I saw that the only part of Sardinia mapped on Panoramax was the area I was researching, I knew I was on the right track.
This was further confirmed when I noticed the vehicle’s view matched the challenge photo.
With this, I easily traced the vehicle’s route and found the exact viewpoint from the challenge.
After a few attempts to pinpoint the location:THC{1_4m_4lm0st_1mpr3ss3d…_jk_Hum4ns_4r3_P4th3t1c}