Day 5: Capstone - Capture The Flag and OSINT

CyberQuest Summer Camp - day deck

This is your hands-on companion to the main course deck. The main deck (Interactive_Slides.html) sends you to specific Parts here and to Modules in the notebook, then back. You can also run this deck on its own, top to bottom, with the Next arrow.

Morning Kickoff: Motivation & News (09:00 AM - 09:15 AM)

• Case Profile: The DEF CON Capture the Flag Finals. Every year, global teams compete in continuous attack-and-defense challenges, showcasing how gamified exercises prepare professionals to handle real-world threat incidents.

Teaching Session I: Core Lecture (09:15 AM - 11:15 AM)

Capture the Flag (CTF) Competition Frameworks

• Jeopardy-Style CTF: A cybersecurity competition format where participants choose challenges from distinct categories (such as Cryptography, Reverse Engineering, Web Exploitation, Forensic Analysis, and Open-Source Intelligence). Solving a challenge reveals a hidden text string called a flag, which players submit to a scoreboard to earn points.

Professional Industry Certifications

• CompTIA Security+: A globally recognized, vendor-neutral foundational certification that validates the baseline technical skills required to perform core security functions and pursue an entry-level IT security career.
• Certified Ethical Hacker (CEH): A credential issued by the EC-Council that validates a professional's understanding of how to look for weaknesses and vulnerabilities in target systems using the same tools and techniques as malicious hackers, but in a lawful and ethical manner.

Higher Education Academic Pathways

• University Certificate: Short-term, intensive training programs (typically 6 to 12 months) focused on specific technical skill sets like incident response or digital forensics.
• Cybersecurity Minor: A supplementary block of technical courses completed alongside a major degree program (such as Computer Science or Data Analytics) to build baseline security knowledge.
• Associate Degree (A.S. or A.A.): A 2-year undergraduate degree program, often offered by community colleges, that focuses on foundational technical training and hands-on skills for network helpdesk roles.
• Bachelor Degree (B.S. or B.A.): A comprehensive 4-year undergraduate degree program that provides deep theoretical, mathematical, and architectural foundations in computer science, software engineering, and systems security.

Teaching Session II: Labs & Interactive Tools (11:45 AM - 01:45 PM)

Practical Interactive Tools for Today

1. picoCTF: Compete in Carnegie Mellon's beginner-friendly educational hacking platform to solve interactive problems and harvest flags.
2. OSINT Framework: Navigate an interactive index of open-source intelligence gathering tools to learn how public information is gathered for security footprint analysis.

Recap & Camp Graduation (04:15 PM - 04:30 PM)

• Summary: Today we put our skills to the test in the CTF arena, explored professional certification roadmaps, and mapped out university degree pathways.
• Congratulations: You have completed all curriculum modules for the CyberQuest Summer Camp! Keep learning, practice ethically, and help defend the digital frontier.

Your plan for today

6 parts. Press Next to move in order.

1. Part 1. Get oriented - 4 slides
2. Part 2. Learn the basics - 22 slides
3. Part 3. Code along - 1 slide
4. Part 4. Play the free tools - 3 slides
5. Part 5. Test yourself - 7 slides
6. Part 6. Wrap up - 1 slide

PART 1 OF 6

Get oriented

Objectives, key terms, a picture, and the news.

This part is 4 slides. Press Next to begin.

Learning objectives

• Solve real CTF challenges on picoCTF using your week of skills.
• Explain what OSINT is and the ethics that govern it.
• Read file metadata and complete the multi-step capstone flag.

Vocabulary (acronyms expanded and defined)

• CTF = Capture The Flag: a security game where you find hidden flags by solving challenges.
• OSINT = Open-Source Intelligence: gathering information from public sources only.
• EXIF = Exchangeable Image File Format: hidden data inside photos, such as time and sometimes location.
• GPS = Global Positioning System: satellite location data.
• White hat: an ethical hacker who always has permission.

Picture it

  Skills you built this week  ->  CAPSTONE
  Linux + Python  +  Passwords  +  Crypto  +  Web  +  AI  =  a junior cyber analyst

In the news (real and verifiable)

picoCTF, created by security experts at Carnegie Mellon University, is one of the largest free Capture The Flag programs and has introduced hundreds of thousands of students to cybersecurity. Capture The Flag is also a headline event at major security conferences such as DEF CON, where professional teams compete.

PART 2 OF 6

Learn the basics

Now go deeper: the core ideas step by step, with quick knowledge checks.

This part is 22 slides. Press Next to begin.

Ethics first

The white-hat rule

OSINT = Open-Source Intelligence: using only public information, only on targets you are allowed to investigate.

• Never harass anyone.
• Never access private accounts.
• Always have permission.

Knowledge check

Before investigating with OSINT you must...

What is Capture The Flag?

The game of hacking skills

CTF = Capture The Flag: solve puzzles to find hidden text called flags.

picoCTF{you_found_me}

picoCTF is built by Carnegie Mellon University and is free.

Knowledge check

A picoCTF flag usually looks like...

Metadata and EXIF

Hidden data in files

Photos can carry EXIF data: time taken, camera model, and sometimes GPS location.

EXIF = Exchangeable Image File Format. Strip it before posting private photos.

Knowledge check

EXIF data in a photo can reveal...

Ethics first

OSINT uses only information that is already public, and only on targets you are allowed to investigate: a practice account, a fictional persona, or yourself. Never harass anyone, never try to access private accounts, and always have permission. This rule is what separates a security professional from a criminal.

Where to go next

Keep your free picoCTF account, join or start a cyber club, and look into the CyberPatriot program and local CTF events. Free continued practice: picoGym, OverTheWire, and CTFLearn.

What is Capture The Flag?

The game of hacking skills

A CTF is a security game where you solve puzzles to find hidden text called flags, written like picoCTF{you_found_me}. It is a safe, legal, fun way to practice real skills.

CTF categories

What you might solve

Two CTF styles

Jeopardy and attack-defense

Jeopardy: a board of standalone challenges worth points, best for beginners (this is picoCTF). Attack-defense: teams defend their own services while attacking others, used in advanced competitions.

Red team versus blue team

Illustration

Red attacks with permission, blue defends. The best pros understand both sides.

Ethics first

The white-hat rule

OSINT and hacking skills are used only with permission and only on targets you are allowed to test. Never harass anyone, never access private accounts. Permission is the line between a professional and a criminal.

What is OSINT?

Open-Source Intelligence

OSINT means gathering information from public sources only: websites, public profiles, and published documents. Investigators, journalists, and defenders all use it within the law.

Hidden data in a photo (EXIF)

Illustration

Metadata rides inside image files. Strip it before posting photos you want private.

OSINT Framework

A map of free tools

The OSINT Framework is a clickable map grouping free investigation tools by category (usernames, images, domains, and more). It is a starting point for learning what public data exists.

Username investigation

Patterns across sites

People often reuse one username. Investigators check whether it exists on many sites by visiting public profile URLs. You only ever look at public pages, never private accounts.

Protect your own footprint

Turn OSINT on yourself

Search your own name and usernames, review privacy settings, strip photo metadata, and remove old public posts. Knowing what is exposed helps you defend it.

Knowledge check

Before investigating a target with OSINT you must...

Cybersecurity careers

Where this leads

Certifications and next steps

Keep going

Keep a free picoCTF account, join or start a cyber club, and try CyberPatriot. Later, common starter certifications are CompTIA Security+ and the Certified Ethical Hacker.

Knowledge check

A picoCTF flag looks like...

CTF categories at a glance

Ch 16 §16.2 — seven flavors of challenge

CTF formats

Ch 16 §16.6 — three competition structures

OSINT: 5-step methodology

Ch 7 — passive reconnaissance

Google dorks

Ch 7 §7.2 — search engine OSINT techniques

Search operators for targeted recon

Image metadata: GPS in your photos

Files reveal more than you think

Every JPEG from a smartphone embeds EXIF metadata: camera model, date/time, and often GPS coordinates. This is a forensics and OSINT goldmine.

# Concept: read EXIF data with Python Pillow (or exiftool on Linux)
from PIL import Image
from PIL.ExifTags import TAGS

img = Image.open("photo.jpg")
exif = img._getexif() or {}
for tag_id, value in exif.items():
    tag = TAGS.get(tag_id, tag_id)
    print(f"{tag}: {value}")
# may print: GPSInfo: {1: 'N', 2: ((38,0,58.2),...), ...}

CTF demo: base64 decode

Ch 16 §16.4 — encoding challenges

Classic beginner challenge — 3 lines of Python

You are given: Q1RGe2Jhc2U2NF9pc19ub3RfZW5jcnlwdGlvbn0=

import base64
ct = "Q1RGe2Jhc2U2NF9pc19ub3RfZW5jcnlwdGlvbn0="
print(base64.b64decode(ct).decode())
# CTF{base64_is_not_encryption}

Also watch for: hex strings (0x or all 0-9A-F chars), ROT13 (all letters, readable-ish), and URL encoding (%41 = 'A').

CTF demo: Caesar brute-force

Ch 16 §16.6 worked example

Challenge: IODJ{euxwh_irufh_fdvhdu}

def caesar(text, shift):
    result = []
    for ch in text:
        if ch.isalpha():
            base = ord('A') if ch.isupper() else ord('a')
            result.append(chr((ord(ch) - base + shift) % 26 + base))
        else:
            result.append(ch)
    return ''.join(result)

for shift in range(1, 26):
    candidate = caesar("IODJ{euxwh_irufh_fdvhdu}", shift)
    if candidate.startswith("FLAG{"):
        print(f"Shift {shift}: {candidate}"); break
# Shift 23: FLAG{brute_force_caesar}

CTF demo: XOR known-plaintext

Ch 16 §16.4 — crypto challenges

Key recovery when you know the plaintext format

Challenge: ciphertext bytes given. You know the flag starts with FLAG{.

ct_hex = "040e0305393a2d301d2b311d24372c1d232c261d3027342730312b202e273f"
ct = bytes.fromhex(ct_hex)

# XOR the first known byte 'F' (0x46) with ct[0] to guess the key
key = ct[0] ^ ord('F')   # 0x42

# decrypt
pt = bytes(b ^ key for b in ct)
print(pt.decode())   # FLAG{xor_is_fun_and_reversible}

CTF skills to job roles

Ch 16 §16.5 — where this leads

Certification roadmap

Ch 16 §16.5 — career progression paths

App. C — your path forward

Knowledge check

Which CTF category maps most directly to the job role of "digital forensic examiner"?