OSINT CTF Walkthrough: Tracking a Most Wanted Fugitive Using Passive Intelligence

In this walkthough, I will break down the passive Open Source Intelligence (OSINT) methodology used to locate two critical missing data points regarding a high-profile target: Lamar T. Browning. Browning is wanted by federal authorities for alleged involvement in a drug trafficking conspiracy.

The challenge required strict adherence to passive reconnaissance—meaning zero interaction with the target, their associates, or any accounts—to identify:

1. The high school he attended.
2. His last known “Current Address”.

By leveraging targeted search operators (Google Dorks), Social Media Intelligence (SOCMINT), and public record aggregators, I was able to bypass the media saturation surrounding his case and extract actionable intelligence.

1. The Subject & Initial Intelligence

The starting intelligence provided several strong pivot points for digital profiling:

• Aliases: Lamar Thomas Browning, Lamar Webster.
• DOB: November 14, 1985 (Age approx. 40).
• Operational Area: Indianapolis, Indiana.
• Physical Markers: Distinctive tattoos on both arms and wrists.

Initial base-level searches for "Lamar Browning" primarily yielded local news reports detailing the ongoing manhunt and legal charges. These reports are useful for understanding the subject’s background but rarely contain precise historical or residential data.

2. Phase 1: Identifying the High School (SOCMINT)

The first objective was to establish the suspect’s educational background. Knowing his birth year (1985), I could estimate his high school attendance between roughly 2000 and 2004 in the Indianapolis area.

To filter out news noise, I applied the following dork to specifically target educational identifiers within Indiana:

"lamar browning" ("high school" OR "yearbook") ("Indianapolis" OR "Indiana")

This search surfaced a crucial footprint: a Facebook profile associated with the name “Lamar Browning” and the Indianapolis location. Passive analysis of the public-facing profile was necessary to verify the identity before extraction.

I verified the identity by comparing the Facebook profile picture against the official FBI fugitive mugshot. The distinctive facial features confirmed a positive match.

Once the profile was validated, I extracted the education intelligence directly from the public bio.

• Finding 1: The subject attended Broad Ripple High School.

3. Phase 2: Extracting the Last Known Address (Public Records)

The final objective required finding a specific current address. I shifted focus from educational ties to public record aggregators that index US residential history (e.g., Whitepages, FastPeopleSearch).

I pivoted the search parameters to combine his verified name with his known operational city and the term “address” to locate public listing directories.

"lamar browning" ("Indianapolis") address

The top result was a public records aggregation profile on Whitepages for “Lamar Thomas Browning.”

By analyzing this public directory entry, I corroborated the identity further using the known middle name (Thomas) and age, which matched the FBI’s data. The current active address listing was cleanly extracted.

• Finding 2: The last known current address is 245 W 38th St, Indianapolis, IN 46208.

Summary of Findings

The passive OSINT cycle was completed by combining the extracted data into the required capture-the-flag format.

• Target: Lamar T. Browning
• NCIC: W231482215
• High School: Broad Ripple High School
• Current Address: 245 W 38th St, Indianapolis, IN 46208