NullOrigin CTF Qualifiers

OSINT Challenges

Challenge Name: Operation: The Forgotten Alias

Category: OSINT

Flag: NullOriginCTF{mastermind_Cyph3rWa1t}

Challenge Description

The challenge begins with a seemingly vague historical clue about two individuals who participated in an old CTF together.

The key clues were:

“Two years ago, two strangers walked into a battlefield. They left together at Position 77.”

And:

“If you find the event, you’re halfway there.
If you find the team, you’re close.
If you find the captain’s first alias, you’ve already opened the vault.”

The objective was to identify the CTF event, locate the team that finished 77th, and recover the usernames used by both members during that event.

Solution

Step 1 — Start with Recon on the Captain

The first step is not to immediately search for the CTF leaderboard.

The challenge refers to:

“One of them would later become the captain.”

The captain referenced in the challenge is:

Charlie001 — Mithun M Achary

Therefore, the first step is to perform basic OSINT reconnaissance on the captain.

Possible search queries include:

Charlie001 Mithun M Achary
"Mithun M Achary" CTF
"Charlie001" CTF
"Mithun Achary" cybersecurity

The goal is to identify publicly available profiles and activity associated with the captain.

Screenshot — Captain Recon

Step 2 — Pivot to LinkedIn

During the reconnaissance, the captain’s LinkedIn profile becomes an important pivot.

The challenge gives the clue:

“Two years ago…”

This suggests looking through the captain’s older activity/posts rather than focusing only on recent information.

Navigate to the captain’s LinkedIn profile and inspect the older posts.

Step 3 — Find the 2-Year-Old Post

While going through the LinkedIn activity, an older post from approximately two years ago provides the critical lead.

The post references the CTF/event in which the captain participated.

This is the turning point of the investigation.

The challenge’s wording:

“Long before the rise of the crew, before the rankings, before the reputation…”

is intended to push the player toward finding an older historical event, rather than something related to the captain’s current activities.

Screenshot — The 2-Year-Old LinkedIn Post

Step 4 — Identify the CTF Event

The information from the LinkedIn post can now be used to identify the relevant CTF event.

At this point, search for the event’s historical leaderboard.

Useful searches include:

<CTF name> leaderboard
<CTF name> CTFtime
<CTF name> teams
<CTF name> standings

The important objective is to locate the historical leaderboard/standings for the event.

Screenshot — CTF Event / Leaderboard

Step 5 — Look for Position 77

Now the clue from the challenge becomes highly specific:

“They left together at Position 77.”

Navigate through the event leaderboard and find:

Position: 77

The team occupying this position is the team we are looking for.

Step 6 — Identify the Two Members

Opening the team information reveals the members who participated in the event.

The two usernames associated with the team were:

mastermind
Cyph3rWa1t

These are the historical aliases used by the two participants during the CTF.

This also explains the wording:

“Names change.
Teams disappear.
Profiles are abandoned.
But the internet never forgets.”

The objective was not necessarily to find their current identities directly, but to recover the aliases they used during that particular historical event.

Screenshot — Team Members

Step 7 — Connect the Captain to the Historical Alias

The challenge provides one additional confirmation clue:

“If you find the captain’s first alias, you’ve already opened the vault.”

The captain’s historical alias from the event is:

mastermind

The other participant is:

Cyph3rWa1t

Therefore, the two required usernames are:

mastermind
Cyph3rWa1t

Step 8 — Construct the Flag

The challenge specifies the flag format:

NullOriginCTF{username1_username2}

Substituting the recovered usernames:

NullOriginCTF{mastermind_Cyph3rWa1t}

Final Flag

NullOriginCTF{mastermind_Cyph3rWa1t}

Complete OSINT Chain

The intended solve path can be summarized as:

Challenge
   │
   ▼
Recon on captain
Charlie001 / Mithun M Achary
   │
   ▼
Find LinkedIn profile
   │
   ▼
Inspect older activity
   │
   ▼
Find ~2-year-old LinkedIn post
   │
   ▼
Identify CTF event
   │
   ▼
Find historical leaderboard
   │
   ▼
Position 77
   │
   ▼
Identify team
   │
   ▼
Recover two historical aliases
   │
   ├── mastermind
   │
   └── Cyph3rWa1t
   │
   ▼
NullOriginCTF{mastermind_Cyph3rWa1t}

Key OSINT Techniques

• People reconnaissance — starting from a known alias/name.
• Social-media pivoting — using LinkedIn as the bridge to historical information.
• Historical activity analysis — looking through older posts rather than only current information.
• Timeline correlation — using the “two years ago” clue.
• CTF leaderboard enumeration — locating a specific historical ranking.
• Team/member pivoting — moving from an event to a specific team and then its members.
• Alias recovery — identifying usernames used by participants during the historical event.

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

Challenge Name: The Forgotten Frames

Category: OSINT

Flag: NullOriginCTF{lia_toklikishvili}

Challenge Description

The challenge provides five photographs from a remote mountainous region. The first clue tells us:

“Start with the stranger’s stone.”

The objective is to identify the person connected to the damaged gravestone visible in the photographs and follow the trail through Georgian history, literature, and documentary metadata.

The final clue says:

“The architect of the words wears two faces, one seen and one unseen.”

The challenge ultimately requires identifying the person behind the documentary’s screenplay.

Solution

Step 1 — Examine the Five Photographs

The first step is to carefully examine the five photographs provided with the challenge.

The most important visual clue is a damaged memorial/grave slab located in the mountainous environment.

The challenge tells us:

“Start with the stranger’s stone.”

This indicates that the gravestone is the starting point for the OSINT investigation.

Step 2 — Identify the Gravestone

Searching for information about a foreigner buried in the mountainous region of Georgia leads to Elfride Kurella, a German woman who died in 1957 in the Arkhot region.

A particularly useful source is an Ambebi article about the German couple who became connected with Khevsureti.

The article provides several details that match the challenge photographs extremely well:

• The grave is located in Arkhot.
• The memorial slab contains a German-Georgian inscription.
• The memorial slab was damaged after being hit by a rock.
• The impact broke the slab into four pieces.

This is especially important because the damaged stone visible in the challenge photographs has the same distinctive appearance.

The article also discusses the story of the German couple and their connection to the region.

Source: Ambebi — German couple in Khevsureti

Step 3 — Establish the Arkhot Connection

The information gathered so far gives us a strong chain:

Damaged gravestone
        ↓
Elfride Kurella
        ↓
Died in 1957
        ↓
Arkhot, Georgia
        ↓
German-Georgian memorial
        ↓
Stone broken into four pieces

The Ambebi article also connects Elfride Kurella’s story with Georgian literary history, including a story by Guram Rcheulishvili.

This gives us another direction to investigate instead of stopping at the identity of the person on the grave.

Step 4 — Follow the Reel/Documentary Clue

The challenge contains a clue referring to a reel.

This suggests that the next part of the investigation involves a film or documentary connected to Arkhot.

Following the Arkhot and Georgian cultural connections leads to the documentary:

Gamagrdit Arkhotionno
გამაგრდით არხოტიონნო

The investigation now becomes:

Elfride Kurella
        ↓
Arkhot
        ↓
Georgian historical/literary connection
        ↓
Documentary
        ↓
Gamagrdit Arkhotionno

Step 5 — Find the Official Documentary Page

The next step is to locate an authoritative source for the documentary.

The Georgian Public Broadcaster’s 1TVPLAY page contains the official information for Gamagrdit Arkhotionno.

Source: 1TVPLAY — Gamagrdit Arkhotionno

Get M4$T3R_M!N&’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

The page provides the documentary’s credits and metadata.

Step 6 — Investigate the Credits

The challenge gives us the final major clue:

“The architect of the words wears two faces, one seen and one unseen.”

Instead of simply looking at the obvious documentary information, we need to examine the credits.

The official 1TVPLAY page lists the authors as:

• Eter Tataraidze
• Amiran Arabuli
• Lia Toklikishvili

It also specifically lists:

Screenplay — Lia Toklikishvili

This is the key discovery.

Step 7 — Interpret the Final Clue

The phrase:

“The architect of the words”

points toward the person responsible for the screenplay.

That person is:

Lia Toklikishvili

The clue about “two faces” refers to her appearing in more than one role within the documentary credits:

Lia Toklikishvili
       │
       ├── Author
       │
       └── Screenplay

The screenplay credit is particularly important because it directly matches the wording “architect of the words.”

Therefore, the intended answer is:

lia_toklikishvili

Step 8 — Construct the Flag

The challenge uses the following format:

NullOriginCTF{username}

Using the identified name:

NullOriginCTF{lia_toklikishvili}

Final Flag

NullOriginCTF{lia_toklikishvili}

Complete OSINT Chain

5 Photographs
      ↓
"Start with the stranger's stone"
      ↓
Damaged gravestone
      ↓
Elfride Kurella
      ↓
Arkhot, Georgia
      ↓
German-Georgian memorial
      ↓
Memorial broken into four pieces
      ↓
Georgian literary connection
      ↓
"Reel" clue
      ↓
Gamagrdit Arkhotionno
      ↓
Official 1TVPLAY metadata
      ↓
Lia Toklikishvili
      ↓
Author + Screenplay
      ↓
"Architect of the words"
      ↓
NullOriginCTF{lia_toklikishvili}

Key OSINT Techniques

• Visual clue analysis
• Identifying a historical person from a gravestone
• Geographic OSINT
• Cross-language research
• Connecting historical information with literary references
• Following indirect media clues
• Finding the official documentary source
• Examining detailed metadata and credits
• Correlating multiple clues before accepting the final answer

Important Sources

• Ambebi — Khevsureti / Elfride Kurella article
• 1TVPLAY — Gamagrdit Arkhotionno

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

Challenge Name: Nostalgia on the Menu

Category: OSINT / GEOINT

Flag: Null0rigin{Le_Arabia_8.56_76.87}

NOTE: During this challenge there was a small mistake in the description part i.e., between the coordinates instead of underscore “ _ ” coma “ , ” was mentioned. But we corrected that mistake by increasing the number of attempts by 5 later. Apologise

Challenge Description

The challenge provides an old photograph from the organizers’ early job-training days.

The description says:

“Back when the event organizers and challenge creators were completing their very first job training in the city…”

and:

“there was one local eatery right near this peaceful pond where we went almost every single day.”

This wording contains an important hidden lead.

The event organizer AMAn and the challenge creator Mithun both had their ILP (Initial Learning Program) joining location as Trivandrum.

Therefore, before even investigating the photograph, Trivandrum becomes a strong geographical lead.

The objective is then to use the photograph and this location clue to identify the exact pond and the restaurant next to it.

Solution

Step 1 — Extract the Location Clue From the Description

The first thing to notice is that the challenge doesn’t explicitly give us the city.

However, the description talks about:

“our very first job training in the city”

This can be connected back to the organizers/challenge creators.

Both the event organizer Aman and challenge creator Mithun had their ILP joining location listed as Trivandrum.

This gives us our first geographical lead:

AMAn
  +
Mithun
  ↓
ILP Joining Location
  ↓
Trivandrum

Therefore, rather than searching the entire internet for a random pond, we can narrow our investigation to Trivandrum, Kerala.

This is an important part of the intended OSINT path because the challenge description itself contains enough information to establish the initial location.

Step 2 — Examine the Photograph

Now that we have a probable city, we can investigate the photograph.

The first step is to carefully inspect the buildings and surroundings for useful information.

One particularly valuable clue can be seen on a building:

ATS Destinations and Tours Pvt. Ltd.

This becomes the next OSINT pivot.

Step 3 — Search for the Company

Search the visible text:

ATS Destinations and Tours Pvt. Ltd.

Searching for the company provides information about its location.

Since we already have Trivandrum as our geographical lead, the company search can be narrowed to that area.

The investigation now becomes:

ILP joining location
       ↓
Trivandrum
       ↓
Photograph
       ↓
ATS Destinations and Tours Pvt. Ltd.
       ↓
Company location

This significantly reduces the search area.

Step 4 — Locate the Area on a Map

Once the location associated with ATS Destinations and Tours Pvt. Ltd. aka Travellers Point is identified, the next step is to inspect the surrounding area using Google Maps.

The challenge description provides another critical clue:

“one local eatery right near this peaceful pond”

So the objective isn’t simply to find the company.

We need to find the pond visible in the photograph and then look for restaurants immediately around it.

The approximate coordinates of the relevant area are:

8.56, 76.87

Step 5 — Identify the Pond

Using the company location as the map pivot, inspect the nearby geographical features.

The pond shown in the original photograph can be correlated with the surrounding map area.

This confirms that we are looking at the correct location.

The GEOINT chain is now:

Trivandrum
    ↓
ATS Destinations and Tours Pvt. Ltd.
    ↓
Company location
    ↓
Nearby pond
    ↓
Match pond with photograph

Step 6 — Search for the Restaurant

The challenge specifically says that the organizers:

“went almost every single day”

to a local eatery located near the pond.

Therefore, after locating the pond, inspect the businesses immediately surrounding it.

One of the nearby restaurants is:

Le Arabia

This matches the restaurant clue from the challenge.

Step 7 — Verify the Coordinates

The restaurant/location can be located around:

https://www.google.com/maps/@8.5634298,76.875806,32a,90y,263.92h,89.5t/data=!3m7!1e1!3m5!1suEqnE_uJbcaXXb7EGCJF_Q!2e0!6shttps:%2F%2Fstreetviewpixels-pa.googleapis.com%2Fv1%2Fthumbnail%3Fcb_client%3Dmaps_sv.tactile%26w%3D900%26h%3D600%26pitch%3D0.4956786642113542%26panoid%3DuEqnE_uJbcaXXb7EGCJF_Q%26yaw%3D263.9216410082463!7i16384!8i8192?entry=ttu&g_ep=EgoyMDI2MDkyMC4wIKXMDSoASAFQAw%3D%3D

Latitude:  8.56
Longitude: 76.87

The challenge specifies that the coordinates should be rounded to two decimal places.

Therefore:

8.56,76.87

Step 8 — Construct the Flag

The intended flag format is:

Null0rigin{Restaurant_Name_Latitude,Longitude}

The recovered information is:

Restaurant: Le Arabia
Latitude:   8.56
Longitude:  76.87

Therefore:

Null0rigin{Le_Arabia_8.56_76.87}

Final Flag

Null0rigin{Le_Arabia_8.56_76.87}

Complete OSINT / GEOINT Chain

CHALLENGE DESCRIPTION
                       │
                       ▼
        "Our very first job training"
                       │
                       ▼
        Check organizer / creator
              background clues
                       │
              ┌────────┴────────┐
              ▼                 ▼
            AMAn              Mithun
              │                 │
              └────────┬────────┘
                       ▼
             ILP Joining Location
                       │
                       ▼
                   Trivandrum
                       │
                       ▼
              Examine photograph
                       │
                       ▼
       "ATS Destinations and Tours
                Pvt. Ltd."
                       │
                       ▼
             Search company
                       │
                       ▼
              Locate the area
                       │
                       ▼
               Find the pond
                       │
                       ▼
           Match pond with image
                       │
                       ▼
          Check nearby restaurants
                       │
                       ▼
                  Le Arabia
                       │
                       ▼
                 8.56, 76.87
                       │
                       ▼
       Null0rigin{Le_Arabia_8.56_76.87}

Key OSINT / GEOINT Techniques

• Contextual OSINT — extracting hidden geographical information from the challenge description.
• People-based reconnaissance — using the organizer and challenge creator as initial pivots.
• Location correlation — identifying the common Trivandrum ILP joining location.
• Image reconnaissance — extracting the visible company name from the photograph.
• Business OSINT — searching for ATS Destinations and Tours Pvt. Ltd.
• Geospatial pivoting — transferring the discovered business location to a map.
• Visual-to-map correlation — matching the pond in the photograph with the real-world pond.
• Nearby POI analysis — checking restaurants surrounding the pond.
• Coordinate extraction — obtaining and rounding the final coordinates.
• Flag construction — combining the restaurant name with its coordinates.

Thanks for Reading! 🎯

Thank you for participating in NullOrigin CTF 2026 and for taking the time to read through this writeup!

We hope you enjoyed solving the challenge and exploring the OSINT/GEOINT investigation behind it. 🕵️‍♂️

If you found the challenge or writeup interesting, please support us by liking the post and sharing it with other CTF enthusiasts! ❤️

Your support motivates us to create more challenging and interesting CTFs in the future.

See you in the next challenge! 🚩