OSINT Industries CTF: Digital Footprints, Tattoos, and the Case of Alex Harkály
Bu çözümün Türkçesi de var: sağ üstten dili TR yapın.
Introduction & Scenario
In this challenge, we investigated public OSINT data regarding HARKÁLY Alex, an individual featured on the Europol Most Wanted list for attempted murder in Hungary. According to official notices, investigators noted that the suspect operated social media profiles containing over 50 self-recorded videos displaying distinctive identifying tattoos.
Our objective was to identify the specific social media profile he lost access to, enumerate his distinctive tattoos, transcribe the tattoo below his shoulder, extract the lost account’s handle, and determine the exact date of the first uploaded video.
Step 1: Initial Discovery via Google Dorking
We began with a straightforward Google search query:
alex Harkály social
Step 2: Analyzing the Active Profile (@harkalyalex)
Navigating directly to tiktok.com/@harkalyalex, the uploaded media confirmed that the profile belonged to the suspect pictured in Europol’s database.
Reviewing the uploaded videos chronologically:
- In a video published on 2022-01-31, the suspect appeared shirtless, providing clear visibility of the ink on his upper body.
- Inspecting his right triceps just below the shoulder revealed text stylized in uppercase:
ALBI. - Visible markings on his arm included a tribal shoulder pattern, the triceps text, and a forearm sleeve.
Comparing this against mugshots and footage revealed an additional tattoo placed on the side of his neck, bringing the total count of identifiable tattoos to 4.
Step 3: The Trap & Finding the Lost Account
Submitting the parameters using the current account handle (harkalyalex) failed. Re-reading the prompt highlighted a crucial nuance: What is the username of the account the suspect lost access to?
Inspecting the pinned video at the top of the feed revealed a screen recording captured from a mobile device. In the top overlay, an address intended as a login credential/identifier was visible:
harkalyalex17gemail.comNoticeably, it contained a typo: gemail instead of gmail.
Step 4: Locating the Abandoned Profile & Timestamp Verification
Searching TikTok directly for harkalyalex17@gemail... exposed the dormant, older account:
- Username / Handle:
user2213856012502/harkalyalex17gemail.com
Filtering this older feed to its earliest post surfaced an outdoor recording showing the suspect in a pink shirt. The upload timestamp on this first post was 2020-5-21.
Flag Submission
- Text on Right Triceps:
ALBI - Number of Tattoos:
4 - Lost Username:
harkalyalex17gemail.com - Date of First Video:
2020-5-21
OSINT{ALBI_4_harkalyalex17gemail.com_2020-5-21}Originally published on Substack