Mini note: I didnt solve these challenges in the CTF event

# To the sky


First of all, the description mentioned "social media," so I searched the ones I know, X and Instagram, and discovered these two accounts.





After checking these accounts with WebArchive, I didn't find anything suspicious.


And after searching with whatsmyname, I found his GitHub account.


I checked this link, and it seems to be just a music...

His repo have 2 commits, so I also checked it and found something:



This link redirects to the YouTube link above :v, so we didn't find anything special here either.

---

**Analyze Step**: The description mentions `social media`, and we searched on popular platforms. All three accounts share the same username, but we couldn't find anything new here. Therefore, there might be other accounts on different platforms

---
We need to narrow down the search scope by checking which country he is from


I checked his last name by searching on LinkedIn and found another person with the same last name from France. Therefore, we can conclude that he might be from France.


In my opinion, to achieve the most accurate results, we should use the language of that country for the search.

I searched with `top social media in France`, translated to `les meilleurs réseaux sociaux en France`.


After checking a few platforms, we discovered that he uses this social media that we didnt found by `whatsmyname`: `(https://www.tumblr.com/elowenvaelith)`


I noticed this post

When we searched about the flag format, we can see it is a plane

So our mission is that find the plane he mention in this post.

Just copy and paste that post on `Bing`



So the flag is: `wwf{piper_aerostar}`

# Identity


I found his email through GitHub and sent a random message to this Gmail address. I received the following response:


`https://github.com/elowenvaelith/fuzzy-octo-garbanzo/commit/84344b9ca7bf4bf9616cb7d727aa7c22eff05d00.patch/`

put `.patch/` after the commit and then see it


**Analyze Step**:

- He mention about `message me at`
- about pgp :

So we need to find the app/platform use this pgp

I searched `best pgp app`


There are some app:


The first one is just open source


And `keybase` is the platform to message - right with our analyze:




So this platform have a lot of users, so we can find the account of Elowen Vaelith with that pgp.

First, we need to understand how this platform act:

So, I create account to understand that



So this is my key:


We didnt know what is this key meaning, so we need to find the place to decode this key:

I searched `pgp decoder` and find this one:


So first, I decode my key:

Our key have a lot of part:


Next, I decode the key that I gave from Elowen Vaelith:


So, his key gave the information about signature packet:

So next step, we need to check `signature packet` of our key:


From there, we can notice about `keyid`


That `keyid` is the same with the data in my profile:



So that, when anyone click to your profile, they can see this `keyid`

From there, we can find Elowen Vaelith's profile with this `keyid`



But it didnt work with his keyid but mine is yes, idk why :v

So I have to read the docs about api (the top of my search)

And found this one:


Look at another docs to find the format to use key/fetch:


So it is: `https://keybase.io/_/api/1.0/key/fetch.json?pgp_key_ids=e2792425ca477506`


So his username is: `orionjules`


So we found his real name: `Orion Jules Stewart`

`wwf{orion_jules_stewart}`

# Memorial


So, usually, after found his real name we need to find family tree to find his sister:

He is from France so:




So this is her fav song:

`wwf{heads_in_the_clouds}`

# Bulletproof


In the picture, I flip the photo sideways and look in the window to see 3_07 S Tacoma, 98405

So I search on Google Maps: `Tacoma, 98405`

So that, I know it is Tacoma WA 98405


We just simply brute the miss number: 0-9,

When I searched with "9", google mention about Shell:



So it is: `wwf{3907s12thst_tacoma_wa98405_usa}`