Hosted by Correlation One and the Department of Defense, the Cyber Sentinel Challenge was unlike most CTFs—this one was completely solo. The challenges were categorized into Forensics, Recon, OSINT, Malware/Reverse Engineering, Networking, and Web Security.
CTF Duration: 11:00 AM – 7:00 PM ET
Team: Solo
Challenge Topics: Forensics, Recon, OSINT, Malware/Reverse Engineering, Networking, Web Security
Favorite Categories: OSINT and Web Security
OSINT (A.K.A. GeoGuessr on Steroids)
As the clock struck 11, I dove straight into OSINT—the category I felt most confident in. The challenges required locating coordinates within 500 meters of specific buildings. Thanks to my love for travel, I quickly recognized the architecture and a transportation logo in one challenge. A second image—a cake styled after Matilda’s iconic chocolate cake—confirmed the location. I hopped on my favorite social media for foodie pictures, Instagram and searched for “Matilda Cake London,” which sealed the deal.
The next challenge (and admittedly, I forgot the third one!) was significantly harder. It featured two photos from a region not covered by Google Maps and heavily censored—yep, North Korea.
I first tried Picarta AI for rough coordinate guesses, but came up empty. Then I turned to trusty Google Search using descriptive keywords like “Kim Jong Un internet cafe” and “North Korean clock bridge buildings.” This led me to news articles translated from various Asian outlets. They mentioned a new district project called Hwaseong in Pyongyang.
Cross-referencing the articles, I used ChatGPT to find alternative satellite map tools. These maps provided better visibility of rivers, streets, and zones. By comparing these maps to images from an article about Pyongyang’s building phases, I narrowed it down to Phase 3, and boom—found the coordinates.
OSINT Tips:
- Get into GeoGuessr—it sharpens your location-spotting instincts.
- Learn to recognize how different languages appear in logos, street signs, license plates, and storefronts—they’re major clues.
Recon & Web Security
Coming from a background in software engineering and working as a Solutions Engineer, Recon and Web Security felt like second nature. When building web apps, it’s essential to avoid leaking API keys, leaving behind revealing comments, or leaving endpoints vulnerable to SQL injection.
One challenge involved accessing an .onion link to retrieve a flag. Rule #1: never expose your real IP on the dark web. I used ProtonVPN (huge fan of ProtonMail) and accessed the link via the Tor Browser.
💡 Mini Tip: For added safety: go VPN → Virtual Machine → Tor instead of just VPN → Tor. I tend to use Virtual Box since its free, but there are other choices out there.
Once on the site, I filled out a fake scam form (never use real info!) and retrieved the flag.
Other challenges involved exploring website frontends using Developer Tools:
- Elements Tab: Read the HTML/CSS for commented-out hints, weird class names, or embedded JS functions.
- Network Tab: Refresh the page to see API activity and responses.
For deeper analysis, I turned to Burp Suite, which let me:
- Modify and replay API requests
- Tweak headers and cookies
- Interact with endpoints through a clean UI
By testing URL variations like /robots.txt, /common.txt, /admin, /dashboard, or /internal, I was able to trigger new behaviors and find more clues.
Web Recon Tips:
- Try
curlin terminal - Use Postman or Burp Suite for API experimentation
- Get familiar with common hidden URL paths
- Always inspect websites with DevTools—you never know what developers might leave behind!
Final Thoughts
This CTF pushed me to sharpen both familiar and unfamiliar skills. It reminded me why I love cybersecurity—there’s always a puzzle to solve and new tools to add to my belt. Whether it’s analyzing satellite imagery or sniffing through API calls or network packets, each challenge brought something new to the table.
I’ll be doing a deeper dive into the other categories on future blogs —so stay tuned! ( Because Cryptography alone is an INSANE chunk of information to explain alone and Networking with Wireshark will be overwhelming at first ) I will also re-post my first CTF from my dead website over here – now that we are officially live on WordPress.
vivhack 