Operation Illuminate: From Mediterranean Cliffs to Digital Footprints An OSINT CTF Write-Up

Combining geospatial intelligence (GEOINT), open-source investigation (OSINT), and digital archival forensics, the Operation Illuminate challenge series is a cohesive, four-stage investigation that starts with a partially out-of-focus trailhead signboard and concludes in the source code of an archived web domain.

This write-up documents the step-by-step methodologies and tooling utilized to resolve each phase of the track.

Stage 1: Out of Focus (Geospatial Analysis & Summit Verification)

Challenge Overview

Task: What is the name of the coastal town or neighborhood where the main walking trail to this location begins?
Flag Format: osintuk{answer}

Technical Analysis

The investigation began with an image of an individual pointing toward the horizon next to an out-of-focus informational board near a stone-pillar gateway

Three distinct markers were identified upon forensic inspection of the sign:

1. Signboard Branding & Palette: The sky-blue backdrop featuring a white minimalist mountain-and-sea silhouette conforms to the regional graphic design standard established by the Valencian regional natural parks network (Parcs Naturals de la Comunitat Valenciana).
2. Coordinates Grid: The visible parts of the coordinates table read approximately 38° 33.x’ N and 0° 03.x’ W, locating the scene within the Serra Gelada Natural Park (Parque Natural de la Sierra Helada).
3. Terrain & Infrastructure: The masonry pillar and heavy metal gate mark the communications installation atop the Alt del Governador summit (~438 m elevation). The primary paved recreational trail leading toward this ridge and the coastal lighthouse originates in the coastal resort district of L’Albir (within the municipality of L’Alfàs del Pi).

• Flag: osintuk{L'Albir}

Stage 2: Shed Some Light (Cultural Landmarks & Heritage Sites)

Challenge Overview

Task: Identify the location near the previous coordinates where this photo was taken. There is a building directly to the side of this photo location, you must provide the text which is written above the main front entrance.
Flag Format: osintuk{answer} (Replace all spaces with underscores; preserve diacritics and special characters.)

Technical Analysis

The subsequent task presented a midday landscape photograph showing a paved trail winding along a sheer sea cliff.

Tracking the trailhead entrance at L’Albir via Google Street View confirmed the primary interpretive route (Ruta 2: Faro de l’Albir).

Figure 3: The official park gateway and visitor center at Cami Vell del Far in L’Albir.

Following the path shown in Figure 2 leads directly to the terminus of the trail: the Faro de l’Albir (Albir Lighthouse). Today, the auxiliary quarters of the historic 1863 lighthouse serve as an interpretive cultural museum. Directly above the main entrance door, the engraved heading reads:

Centro de Interpretación Faro de l’Albir

Applying the required formatting (replacing spaces with underscores and preserving diacritics):

Flag: osintuk{Centro_de_Interpretación_Faro_de_l'Albir}

Stage 3: The Catch (Ecological & Marine Installations)

Challenge Overview

• Task: Explore the area immediately behind the building from Task 2. One of the information panels details a specific animal and cites a nearby man-made installation as the main reason they are spotted from this location. Provide the Spanish name of the animal and the installation.
• Flag Format: osintuk{animal_installation} (Replace spaces with underscores; preserve Spanish diacritics)

Technical Analysis

Behind the lighthouse complex lies an open observation terrace overlooking the Mediterranean waters. The informational panels erected here outline the local marine biodiversity and coastal economic activity.

A specific panel details the frequent sightings of the common bottlenose dolphin (delfín mular). The documentation highlights that these cetaceans regularly patrol the shallow coastal shelf primarily drawn by the local fish farm facilities (piscifactoría). The captive fish attract shoals of wild fish, creating an abundant feeding ground that brings the dolphins close to the cliffs.

Joining both terms with an underscore while retaining the required accents:

Flag: osintuk{delfín_mular_piscifactoría}

Stage 4: Status Check (Ornithological Identification & Municipal Records)

Challenge Overview

• Task: Inspect the attached video to identify the bird spotted along the trail. Locate the official Spanish PDF guide for this specific trail and retrieve the Spanish term listed immediately next to “Presencia” in the document’s fauna section.
• Flag Format: osintuk{answer}

Technical Analysis

The attached surveillance footage captures a game bird foraging near the limestone rockface adjacent to the path.

Key morphological markers identified from the footage:

• Distinct coral-red beak and legs
• Broad black-and-white lateral flank barring
• White throat patch encircled by a pronounced black gorget

These markers conclusively identify the specimen as a Red-legged partridge (Perdiz roja / Alectoris rufa).

An open-source query for the official natural park documentation yields the municipal nature publication: Guia Faro en Castellano (available via environmental archives and document repositories such as Scribd).

Navigating to the fauna section (page 13) under the Perdiz roja species card, the field labeled Presencia: explicitly denotes:

Presencia: Residente.

Flag: osintuk{Residente}

Stage 5: Analytics Code (Digital Archiving & Source Inspection)

Challenge Overview

• Task: Identify the primary website URL connected to the landmark at the end of the trail on Google Maps. Extract the Google Analytics ID associated with this website.
• Flag Format: osintuk{UA-...}

Technical Analysis

Navigating to the Google Maps entry for Faro de l’Albir links to the promotional tourism website: visitalbir.com.

Visiting the domain directly reveals that the web server is inactive, displaying a generic domain parking lander from Network Solutions.

Because the live property no longer executes original telemetry tracking, the investigation shifts to temporal digital forensics using the Wayback Machine (Internet Archive).

Inspecting the archived DOM tree and source code (view-source:) of a previously healthy capture reveals the tracking snippet embedded within the global site tag script block:

<!-- Global site tag (gtag.js) - Google Analytics -->
<script async src="https://www.googletagmanager.com/gtag/js?id=UA-131201757-1"></script>
gtag('config', 'UA-131201757-1');

Extracting the Universal Analytics ID:

Flag: osintuk{UA-131201757-1}

Author & Connect

• Substack: Alp Akciğer
• LinkedIn: Alp Akciğer
• GitHub: alpakciger / Chronos
• TryHackMe: alpakciger