ISSessions CTF 2025 Google Sus Writeup

February 10, 2025

Google Sus was a fun OSINT challenge me and my teammate solved roughly a minute after the competition ended 😔

Challenge

The exact wording of the challenge is unavailable as of writing, but we were given a name “Wilford Von Bugsy”, who reportedly had bad opsec, and a 0-cost hint referencing wine.

Info Aggregation

DuckDuckGoing the term “Wilford Von Bugsy” gives us 2 leads - A LinkedIn and a Flickr account.

The Flickr is a red herring - literally

The LinkedIn has some interesting info - narrowing our target down to at least having history in the GTA, and letting us know that he went to Sheridan for a Bachelors in Animation. Furthermore, according to the program website the program is only offered in the Oakville campus, narrowing down location even more.

What a pivot

The LinkedIn also has an email in the “Contact Info” section

My teammate ran the email through the OSINT tool EPIEOS and got 3 hits

1. Google (duh)
2. Flickr (already found)
3. Vivino (???)

Deeper look

A wine ordering website. Looks like were on the right track.

When looking further into the Google account, we found a Google Maps profile associated with the account with a few contributions

A single review and 3 answers. Since this account was made specifically for the CTF, we can assume these are meaningful and part of the challenge. However, these isn’t a way to retrieve reviews by profile, probably intentionally to avoid the exact thing that we’re doing.

Back to Vivino, after looking at the URL structure for user profiles (for the site’s review feature) and a lucky guess as to what his username might be, we’re at his profile.

https://www.vivino.com/users/wilford.von.bugsy1982

A sports pub and grill near his college? Good thing we know exactly where his college is. The first result in Google Maps to “sports pub and grill near sheridan oakville” was our place - Monaghan’s Sports Pub & Grill.

Wait, didn’t he have a Google Maps review? My teammate found it by simply sorting the reviews by new.

We get a strangely specific hashtag and a reference to him posting pictures. It’s not his Flickr, so maybe Instagram?

They’re somehow hidden, but theres definitely posts here (unless some other team who got this far is trying to mess with us). The images are of burgers at Monaghan’s, so my teammate had the idea of searching by location instead. With that, we were able to narrow it down to a single account called @notorious_wvb.

From here the flag is obvious. Here’s a mind map of our entire search.