OSINT Tracking a Subject In a Crowd

 OP Save Stitch, a favor for the University’s Student Union


So in April, while my Universities Student Union was at an event for all unions around the country, there was a coemption held where all the mascots in our case it is a stitch of each union was taken by one, and it was up to the other unions to locate the union that had taken the mascot, and rescue them.

This was alerted to the union through a made twitter profile with a  message and picture, which are bellow

Of coursing being the CEO of the biggest society in the university, that also happens to be the Ethical Hacking Society aka HackerSoc or @HackerSoc on twitter, I got a 10 pm call about this being asked for help by the union to help locate the person.

The first stage for this was to check the twitter for intel anywhere I could.

There was nothing on the main page other than REALLY BAD grammar so we know they weren’t from our university, the account was not following anyone, checking the followers only had other union presidents and vice presidents, all who were themselves posting about having lost their mascots.

so the next thing to do was look for metadata on the images or geodata of the tweets… no geodata and twitter strips the metadata anyway…

Hmmm ok next thing, let’s request a password reset so we can see information attached to the account, not a hard thing just copy the username and say you forgot your twitter password and you get prompted with something like this.

Entering the account username gave us a message “Text a code to my phone ending in 59” so we known the phone number ends with a 59, get the President and VP to check all the known phone numbers they have for one that ends with 59… NONE… no one has anyone’s numbers, they just have them all on Facebook.

so they called me to pool idea, whiling pooling ideas, I could hear in the background over the call random bings and bells… and instantly Binged in my head…


so I instantly formed a plan with my friend who was there who goes by TallPanda, to stand in the center of the room on a video call to me, while I had a utility running on my desktop called Sonic Radar by a company called ROG “Republic of Gamers” who designed it for gamers to find shot directions via sound and mark the audio on a radar system, he would stand there and wait for me to say iv sent a reset text message, then he would listen for the notification. of course, there was a lot of static noise but Sonic Radar was able to level out that and mark and sharp noises such as POP’s or Rings.

*Button Pressed*

TallPanda turned instantly in the direction that was marked on the overlay, to a large group he walked over close, I pressed the button again, 1 , 2 , 3 BRING BRING, boom center of the crowd. TallPanda got closer but couldn’t hear see anything.

Third Times the Charm
1, 2, 3, BRING BRING. to which I and TallPanda both hear “That Sounds Important” and a single person pulls out their phone. Boom target ID’d.

The next stage was on TallPanda to track the guy out of the hall and back to his room to rescue the doll, TallPanda had no issue with doing this, as the only people that knew each other at this point was the Presidents and Vice Presidents of each union.

I was then notified on twitter with the following message, as was required with the challenge.