CSAW CTF 2024 - Authentic Chinese Food

A simple and fun OSINT challenge

Introduction

This challenge from CSAW was a great geolocation/public information challenge, where we needed to identify the address to get further details about the buildings owner, architecture date and the health grade.

Here is the challenge description:

The original file, panda.jpg, from the challenge description:

---

Steps

1.) The first thing to notice about this challenge is the phone number in the top-right of the image. The area code of this number reveals that the Panda Express we are looking for is in Brooklyn, New York.

2.) With this information, the next clear step is to go to Google Maps, and search for “panda express brooklyn ny.” There were a lot less than one may expect, so it was easy to streetview and identify the one in the challenge: 423 Fulton St, Brooklyn, NY 11201.

3.) Now that we have the address, we need to find the owner (LLC) of the building and the year the building was built. Compass.com proved to be a fantastic resource and revealed a bunch of information including that the build date was 1920, and the owner is “BNN Fulton Flushing Owner.” I looked the company up to be sure this was correct because the LLC name was strange. I also spent an unreasonable amount of time digging through New York building records, which all revealed nothing about the owner, albeit I was able to acquire the build year.

4.) NYC maintains good record of health ratings for applicable establishments, so I Googled for the health rating and came across this site, health.nyc.gov and found that the grade was ‘pending.’

5.) With all of this information combined, I submitted my flag and got the solve: csawctf{pending_1920_bnn_fulton_flushing_owner}

---

Lessons Learned

1.) Compass.com is an excellent resource for building records. New York building records are terrible to dig through.

2.) This challenge was unique, and it gives me great inspiration for challenges of my own that don’t limit you to simple geolocation.

3.) Maybe consider other restaurant options if you are in the area looking for authentic Chinese food ;).