---
title: '[EN] Write-up - On the loose 1 & 2'
disqus: hackmd
authors: '6e 61 74 68'
---

# [EN] Write-up - On the loose 1 & 2
GCCCTF 2024 - OSINT Challenge - Author 6e 61 74 68

## Part [1/2]


In this statement, we have two important pieces of information:
* The person we're looking for is "**Satorco M**"
* We're looking for an Instagram account

So we're going to focus on this name and this first letter to find out if he has any accounts on social networks.

> By going to isFred.fr, we can find a list of the main existing social networks in the [Modules](https://isfred.fr/modules) > [Introduction](https://isfred.fr/modules/introduction) > [Introduction to social networks](https://isfred.fr/modules/introduction/intro_reseaux_sociaux) section.

Let's start with Instagram:
We can't find any convincing information on it.

Facebook:
We found a Manuel Satorco!

After a quick look, we manage to find only the first name of our suspect: Manuel, as well as his photo. With no further interesting information, we continue our search.

We also find a result on Twitter:


When we get to his profile, we're going to get a lot of information.
First we discover that he has located his account in Bolivia:

We find a reply to a post on January 24, to which he replies:

We find someone: heliiii
Who is she?


She also appears to be from Bolivia, and given her reply, it's likely that they know each other.

Inspecting her followers, we find an interesting lead on someone else:

Gabriela Harero

In her posts, we find a class photo from their childhood:

In it we see that the famous heliii is mentioned


In the description of the picture, we find her classmates and, above all, heliii's full name (@heliarebloooos): Heliana Reblos


Let's see if we can find something with this first name.

Just follow the same procedure as in the beginning
First, we'll search on Instagram to see if we can find a profile:

We find a profile for Reblos Heliana

His followers include a certain Manuel who bears a striking resemblance to our very own Satorco Manuel.


Congratulations, we have his instagram profile:

FLAG: GCC{elfamosomanuel}

## Part [2/2]:


In this second part, we'll have to find his current city of residence.

We'll focus on his single post on Instagram:


In the comments, he talks about a rendezvous with the famous Heliana.

We also have the location of the rendezvous.
A dog park, less than 100m from a police station.
We'll add a filter on one country, the one that comes up all the time: Bolivia.

We'll use [overpass](https://overpass-turbo.eu/#) to find this place.

> By visiting isFred, you can discover a [training on Overpass Turbo](https://isfred.fr/modules/geoint/overpass_turbo) in the [GEOINT](https://isfred.fr/modules/geoint) module.

Here's a query adapted to the information we have:

[out:json][timeout:1000];
{{geocodeArea:Bolivia}}->.searchArea;
(
nwr["leisure"="dog_park"](area.searchArea);
)->.dog;
nwr(around.dog:100)["amenity"="police"](area.searchArea);
out geom;

Only one result emerges:

Go to google maps and you'll find a famous dog park located in La Paz, Bolivia:

This is where we'll have to take stock and pay attention to any information we might have overlooked.

Their conversation takes place on January 21, 2024, and they arrange to meet on the following Tuesday at 8am: January 23, 2024 at 8am:


If we paid attention to what we saw earlier, we also had a post around this date...
That's right, the twitter post:
This one was posted at 00:49 on January 24, in France, or 19:49 on 23/01/2024 in Bolivia, the very evening of the match!

Heliana posted a photo of a dish at the restaurant.
Manuel replied that the best restaurants on Tripadvisor are always good.

So let's take a look at Tripadvisor, focusing on the city where they met: La Paz.

Tripadvisor ranks the best restaurants by city, which is perfect!

We can see that the top three restaurants in this area are pretty far apart, but the top 4 are really close:

| Restaurant Top 1 | Restaurant Top 2 | Restaurant Top 3 |
| -------- | -------- | -------- |
| |  |  |


Let's go and have a look at the comments of this famous restaurant, removing all the filters, especially on the language of the comments:

We find this comment:

A Manuel S, says he went there last week, and the visit dates back to January, so we've got our man!

If you expand the commentary, you'll see a city displayed under his photo:


We've got his actual city, congrats!

FLAG: GCC{rafaela}

Here's a diagram to sum it all up:

Or a map from OsintTracker: