Category: OSINT

---

What is OSINT?

OSINT stands for Open Source Intelligence - the practice of gathering information from publicly available sources. In CTF challenges, OSINT tests your ability to research, investigate, and piece together clues from the internet, images, videos, wikis, and other public resources.

For this series, the “world” refers to the Hermitcraft Season 10 Minecraft server - one of the most well-known and documented Minecraft servers in the world. The world was archived (made publicly available for download) after the season ended in September 2025.

---

Understanding the Theme: “Mythical Block Game”

The challenge description says: “I found some remnants of a (now archived), but recent world in the Mythical Block Game.”

Mythical Block Game = Minecraft.

The world is described as archived and recent - Hermitcraft Season 10 ended September 30, 2025, at which point the world was archived and made available for download. This fits perfectly.

Key resource: The Hermitcraft Wiki (hermitcraft.fandom.com) documents everything - builds, players, pets, storylines, and more. Note: it returns 403 errors when accessed programmatically, so visit it directly in your browser.

---

Note:The parsing is for only the people who dont play or have minecraft in their machines which makes it easy for them to solve the challenges

Challenge 1: Lore of the World - The Beginnings

Flag: SK-CERT{Mothball}

The Challenge

I found some remnants of a (now archived), but recent world in the Mythical Block Game. Apparently, some odd moustachioed man finished building this approximately half a year ago. Many people considered this his best build yet. But I don’t care for this build, I care for what began it all, in the same exact world. What’s the name of the starter base of this handsome fella?

Solution

Step 1: Identify the server. The screenshot showed a cyberpunk city on floating terrain with a Pac-Man pixel art building and a “GEM” sign. This is Hermitcraft Season 10, specifically the Magic Mountain area, which featured themed districts built by multiple hermits.

Step 2: Identify the moustachioed man. One Hermitcraft member is famous for his moustache: MumboJumbo (Oli). He built his Season 10 mega-base on Magic Mountain - widely considered among his best work.

Step 3: Find his starter base. In Hermitcraft, a “starter base” is the temporary base built at the very start of a season. MumboJumbo’s Season 10 starter base was called “The Mothball” - a unique hanging structure on the side of Magic Mountain with no entrance door (the only way in was to die and respawn inside).

Flag: SK-CERT{Mothball}

Key Takeaways

• Visual clues (pixel art, signs, building style) identify the server and location
• Hermitcraft Wiki is the primary reference for build names and lore
• “Moustachioed man” = MumboJumbo, famous for his moustache

---

Challenge 2: Lore of the World - Bureaucracy

Flag: SK-CERT{MJYAAFK06}

The Challenge

Apparently, this building is among the most hated, not because of the person, but because of what it stands for. A lot of people had (or rather tried) to fill in some kind of document, but unfortunately, due to a really messy bureaucracy, most of them failed. I need to find the document’s name.

Solution

Step 1: Identify the building. The screenshot showed a large interior with chains, sea lanterns, and a cold industrial aesthetic - a waiting-room style layout. The clues pointed to Grian’s Permit Office (Department of Hermit Permits) on Hermitcraft Season 10. This became one of the most memorable storylines precisely because players were forced to fill out deliberately confusing paperwork to get “permits” for their builds.

Step 2: Find the document name. The Hermitcraft Wiki documents the form given to players: Form MJYAAFK06. This deliberately obscure alphanumeric code made the bureaucracy feel intentionally frustrating and absurd.

Flag: SK-CERT{MJYAAFK06}

Key Takeaways

• “Hated because of what it stands for” = institutional/symbolic, not personal
• Hermitcraft storylines are thoroughly documented on the wiki
• Exact codes matter - always verify from primary sources

---

Challenge 3: Lore of the World - Good Doggie

Flag: SK-CERT{mojito}

The Challenge

Not far away from the previous place, I found a really, really good doggie. It’s just chilling there, left all alone. What could the name of such a good doggie be?

Solution

Step 1: Identify the base. The screenshot showed:

• Lime green screen panels - for YouTube thumbnail photography
• Bamboo wood structures with a Japanese torii gate aesthetic
• Sand/white floor
• A campfire and pink cat tree

Every clue pointed to SmallishBeans’ (Joel’s) base - a Tokyo-inspired Japanese cyberpunk build on Magic Mountain, directly adjacent to the Permit Office area.

Step 2: Find the dog’s name. The wolf was lying in the outdoor courtyard with a red collar. The dog’s name tag read Mojito

How to find it: Load the Hermitcraft Season 10 world download in Minecraft Java Edition, navigate to near permits office base on Magic Mountain, and read the name tag directly. Alternatively, visit the Hermitcraft Wiki’s Hermit Mobs page directly in your browser.

Common red herring: Skizzleman (also on Magic Mountain) has a dog named Kevin Bubbles Malone Refrigerator Jimmy Madeye Dugan - but the screenshot is clearly SmallishBeans’ base (green screens + bamboo).

or if you always need something directly we do this

Clues

As challenge states, the dog is "not far away from the previous place" (the Permit Office), placing it in the Magic Mountain area of Hermitcraft Season 10.

Visual Analysis

The screenshot shows:

A tamed wolf (red collar) sitting in a relaxed pose
Cozy area with campfires and tropical/natural aesthetic
Green building elements suggesting Magic Mountain vicinity

Finding the Dog's Name

Researching into Hermitcraft Season 10 pets in the Magic Mountain area revealed the dog’s name is Mojito - fitting the relaxed, tropical vibe of the location.

Flag: SK-CERT{mojito}

Key Takeaways

• Named mobs require primary source verification (world download or wiki)
• Green screens + bamboo = SmallishBeans on Hermitcraft Season 10
• Match ALL visual clues before concluding whose base it is

---

Challenge 4: Lore of the World - Vantage Point

SK-CERT{41,119,298}

The Challenge

I took a flight around the world to a really nice vantage point. As I flew farther from the ground, I managed to snap this picture and freeze this moment in time forever. What are the exact X, Y, and Z coordinates of the place I took the picture from? Flag format: SK-CERT{XXX,YYY,-ZZZ}; FLAG DOESN’T USE DECIMALS.

Analysis

The screenshot showed a wide panoramic view looking south toward spawn, taken from a high elevation through chain-block framed glass windows. Key landmarks visible:

• Gothic castle with a nether portal (Spawn Chunks area by Xisumavoid)
• Tall obelisk/spire tower to the right
• Black chain blocks framing left and right

Research approach:

1. Parse the world’s playerdata folder - each .dat file stores the last saved position of every player
2. One player (UUID: c22c7f21-1c99-4dc4-af1b-38c49d491c17) was found at X=-975.28, Y=239.38, Z=-197.33 in Spectator mode - the CTF maker’s position when taking the screenshot
3. The exact flag coordinates depended on how Minecraft rounds/truncates coordinates for the F3 display, which proved tricky to determine remotely

Key tools used:

• Python NBT parsing of .mca region files
• Direct playerdata parsing via gzip decompression

To solve definitively: Load the world, teleport to X=-975.28 Y=239.38 Z=-197.33, press F3, and read the “Block” coordinates shown. Flag:. SK-CERT{41,119,298}

---

Challenge 5: Lore of the World - Server Room

Flag: SK-CERT{minecraft:redstone_torch-127-Keralis}

The Challenge

I found a polaroid of some kind of server room. On the back side of the polaroid, there’s a message saying: “Ebbg cnffjbeq: rzcyblrr bs gur zbagu>”. I heard the servers store data related to my investigation. Something tells me this is the last place I need to find to learn the origin of everything in this world.

Step 1: Find the Minecraft ID name of the highest man-placed block in the area of this base. Step 2: Find the Y coordinate of the highest man-placed block.
Step 3: Find the employee of the month’s name inside the facility. Flag format: SK-CERT{minecraft:block_id-YYY-employee}

Solution

Step 0: Decode the ROT13 message. <rzcyblrr bs gur zbagu> → ROT13 → <employee of the month> - this confirms what we’re looking for inside the facility.

Step 1: Identify the facility. The screenshot showed a sci-fi underground server room with:

• White/grey smooth stone aesthetic
• Orange crane/robot arms on rails
• Server racks with green displays
• A humanoid figure (gold/copper colored) in the foreground

Critical discovery: A transit map item frame in the world at X=-440, Y=62, Z=-96 showed all hermit base locations. One item frame read:

"Ren's GigaCorp Facility"

This is Rendog’s GigaCorp, NOT MumboJumbo’s Surplus Megacorp - a key distinction that initially led us astray. The similar name “GigaCorp” appears in both, but the server room belongs to Rendog.

Step 2: Find the highest block. After scanning the correct area (Ren’s GigaCorp Facility), the highest man-placed block was:

• Block: minecraft:redstone_torch
• Y: 127

Step 3: Find the employee of the month. Scanning all entities in the world for item frames with hermit names, the employee of the month displayed inside the facility was Keralis.

Flag: SK-CERT{minecraft:redstone_torch-127-Keralis}

Key Takeaways

• Always decode any cipher in the challenge text - ROT13 here confirmed what to look for
• The transit map was crucial - item frames on the in-game transport network listed ALL base locations with their owners’ names
• GigaCorp ≠ Mumbo’s Surplus Megacorp - both use similar corporate names, but they belong to different hermits
• Item frames store entity data - in Minecraft 1.17+, entities (including item frames) are stored in the entities/ folder, separate from region/ files
• Parsing the world directly is the most reliable approach when web searches fail for obscure in-game details

---

General Tips for Hermitcraft OSINT Challenges

1. The Hermitcraft Wiki is your best friend. Visit hermitcraft.fandom.com directly. It documents builds, pets, storylines, items, and named mobs.

2. The world download is the ultimate source of truth. Load it in Minecraft Java Edition to walk around and inspect everything directly.

3. Parse the world programmatically. Python can read .mca region files to find block entities (signs, chests), entities (item frames, armor stands), and playerdata - without needing to launch Minecraft.

4. Know the Hermits. Each of the ~25 Season 10 players has a distinctive building style. Recognizing whose base you’re looking at from a screenshot is a core skill.

5. Magic Mountain was the hub of Season 10. Many storylines (Permit Office, PixelPulse Valley, Magic Mountain Row, GigaCorp) converged here.

6. Item frames are entities, not block entities. In Minecraft 1.17+, they’re stored in the entities/ folder. Scanning only region/ files will miss them.

7. Transit maps are goldmines. The in-game metro system had item frames at stations showing the locations of all hermit bases - a complete map of the world’s points of interest.

---

Technical Reference: Parsing the Hermitcraft World

Region File Structure

Minecraft stores world data in .mca files (Anvil format):

• region/ - chunk data (blocks, block entities like signs/chests)
• entities/ - entity data (item frames, armor stands, mobs) [1.17+]
• playerdata/ - per-player NBT data (position, inventory, gamemode)

The parsing is for only the people who dont play or have minecraft in their machines which makes it easy for them to solve the challenges

---

Resources

Resource	URL	What it’s useful for
Hermitcraft Wiki	hermitcraft.fandom.com	Everything - builds, pets, storylines, items
Hermitcraft subreddit	reddit.com/r/HermitCraft	Community discussions, screenshots, lore
Hermitcraft YouTube	Search “Hermitcraft Season 10”	Watching gameplay to find specific details
Hermitcraft World Download	hermitcraft.com	Directly inspect the world in-game

---

Travellers – OSINT

Challenge 1: Public Transit

Flag Format: SK-CERT{Name_of_the_island}

Overview

A hacktivist group known as Travellers has been sending photos from various locations around the world. In this first challenge, we are given a single image and tasked with two things: identifying where the photo was taken, and then finding the “nearest island” to that location, which is where the group is supposedly meeting.

Step 1: Analyzing the Image

The provided image, travellers_part1.jpg, shows the exterior of a large, modern educational building. Several architectural details stand out immediately:

• The building features floor-to-ceiling glass curtain walls, giving it a very open and transparent look.
• A standout structural element is the cantilevered roof supported by large glulam (glued laminated timber) beams, which is a wood-engineered construction technique often used in sustainable or showcase buildings.
• Through the glass facade, you can see high-tech interior classrooms and workshop spaces, strongly suggesting this is a technical or trades-focused institution.

These features are quite distinctive and do not match a generic office building or residential complex.

Step 2: Identifying the Building

Using a combination of reverse image search and targeted keyword searches such as “modern construction college building wood beams Canada,” the building is identified as the Algonquin Centre for Construction Excellence (ACCE).

The ACCE is located on the Woodroffe Campus of Algonquin College in Ottawa, Ontario, Canada. It is a well-known landmark in the area due to its award-winning sustainable architecture, which makes heavy use of exposed timber and glass. The full address is 1385 Woodroffe Ave, Nepean, ON K2G 1V8, Canada.

Step 3: Locating the Nearest Island

The challenge text says the group is planning to “meet on the nearest island” relative to where the photo was sent from. This requires examining the geography directly surrounding the ACCE building.

Opening a satellite map and inspecting the immediate area around Woodroffe Avenue reveals the following:

• Directly across the street from the college is Centrepointe Park, a public green space.
• Inside Centrepointe Park, there is a man-made pond called Centrepointe Pond.
• In the middle of this pond sits a small, distinct landmass connected to the shore by a bridge. This is the only “island” within walking distance of the college.
• This landmass is officially named Point Island.

Point Island is approximately 600 meters away from the ACCE building entrance, which is about a 7 to 10 minute walk. No other island or island-like landmass exists within a reasonable proximity.

Solution

The meeting point for the Travellers group is the island inside Centrepointe Park, directly across from Algonquin College.

Flag: SK-CERT{Point_Island}

---

Challenge 2: Shopping Centre

Flag Format: SK-CERT{Building_Name}

Overview

In this challenge, investigators have tracked down a second suspect linked to the Travellers group through a popular online forum. The suspect uses the handle BelkaAndStrelka, and a photo connected to their account has been found. The goal is to identify the large building visible directly behind the photographer in that image.

Step 1: Understanding the Username

Before even looking at the image, the username itself offers a clue. “Belka” and “Strelka” are the names of two Soviet space dogs who became famous in 1960 after becoming the first animals to orbit the Earth and return safely. The use of this name strongly suggests a connection to a post-Soviet country or culture, which helps narrow down the geographic region early in the investigation.

Step 2: Analyzing the Image

The image, travellers_part2.jpg, shows a massive modern structure. Key visual identifiers include:

• A large, circular arena built with glass and steel, featuring a distinctive tiered roof that curves around the entire structure.
• Multiple flags are displayed prominently in front of the building. The flags are red and green with a decorative pattern on the hoist side, which matches the national flag of Belarus.
• The overall scale and design of the complex suggests it is a major multi-purpose venue, likely used for both sports events and concerts.

Searching for “large circular arena Minsk Belarus” immediately identifies the building as the Minsk-Arena (Минск-Арена), one of the largest indoor arenas in Eastern Europe, located in Minsk, the capital of Belarus.

Step 3: Finding the Building Behind the Photographer

To identify the building behind the photographer, we need to figure out exactly where they were standing and which direction they were facing.

The photographer is standing in the large pedestrian plaza on the Pobediteley Avenue side of the arena, looking directly at the main entrance. This means they are facing roughly northeast toward the Minsk-Arena. Their back, therefore, is turned toward Pobediteley Avenue (Проспект Победителей), one of the main thoroughfares in Minsk. Using satellite imagery to look at what sits directly across Pobediteley Avenue, southwest of the arena, reveals a large, multi-story modern building. This building is a commercial hub that was built to serve the arena and the large crowds it attracts. That building is the Arena City (ARENAcity) shopping mall, a major retail and entertainment complex. The challenge title, “Shopping Centre,” directly confirms this is the intended answer.

Solution

The building standing directly behind the photographer at the Minsk-Arena plaza is the Arena City shopping mall. Flag: SK-CERT{Arena_City}

---

Challenge 3: A Little Too Urban

Flag Format: SK-CERT{Club_name}

Overview

A third suspect has made the mistake of posting a photo taken in the middle of a city. The challenge notes that this person enjoys going clubbing, and the task is to find the name of the nearest nightclub to the exact spot where the photo was taken.

Step 1: Analyzing the Image

The image, travellers_part4.jpg, depicts a modern urban environment under heavy fog or overcast weather. Two architectural details serve as the primary anchors for geolocation:

• A glass-fronted commercial building with the address 67a clearly visible on its exterior.
• In the background, a blue-glass skyscraper that appears to be under active construction, rising above the surrounding buildings.

Step 2: Identifying the Location

The number “67a” on the building facade is a direct street address. Combined with the recognizable blue-glass tower under construction in the background, a targeted search for this combination points to a specific location in Brno, Czech Republic.

The glass tower visible in the background is identified as the Sumavska Tower (Sumavska vez), a well-known high-rise development in Brno. The building displaying “67a” in the foreground is the Sumavska 67a business center, a modern glass commercial complex. The photographer is standing in the plaza directly in front of the Sumavska 67a building, at approximate coordinates 49.2104° N, 16.5966° E.

Step 3: Finding the Nearest Nightclub

With the exact location established, the next step is to find the closest nightclub. A proximity search from the entrance of the Sumavska 67a business center is conducted using satellite imagery and local map data.

A measurement of approximately 180 meters from the building leads directly across Kounicova Street and into an adjacent residential block associated with a university area. The venue located at the end of this line is Music Club Alterna, commonly referred to simply as Alterna club.

While other bars or entertainment venues exist in the wider Brno area, no other nightclub falls within a shorter radius from the photographer’s position. The 180-meter measurement is the definitive confirmation that Alterna club is the intended answer.

Solution

The nearest nightclub to the photographer’s position at Sumavska 67a in Brno is the Music Club Alterna.

Flag: SK-CERT{Alterna_club}

---

Challenge 4: A Beautiful View

Flag Format: SK-CERT{Name_of_the_cafe}

Overview

Another member of the Travellers group has shared a photo online. This challenge provides an image taken at what appears to be a scenic outdoor landmark. The clue states that this suspect loves coffee, and the task is to find the name of the nearest cafe to wherever the photo was taken.

Step 1: Analyzing the Image

The image, travellers_part3.jpg, shows a striking architectural structure that provides several strong geolocation clues:

• A large, modern stone amphitheater with a classical Roman-style stage backdrop, known architecturally as a scaenae frons. This is the decorative facade that stands behind the stage area in ancient and modern recreated theaters.
• The structure is built on terraced stone seating arranged in a semicircular pattern.
• The surrounding landscape is arid and semi-dry, with rolling hills and distant high mountains visible on the horizon.
• The photo appears to be taken at sunset or golden hour, based on the warm light over the mountains.

Step 2: Identifying the Location

The combination of a modern Roman-style amphitheater, arid hills, and visible mountains in the background is a strong match for a specific landmark. Searching for “modern Roman amphitheater Iraq mountains” leads to the Erbil Amphitheater, located within Shanadar Park (also known as the Minaret Park area) in Erbil, Iraq.

Erbil is the capital of the Kurdistan Region of Iraq and is surrounded by the Zagros Mountain range, which matches the mountains visible in the background of the photo. The Erbil Amphitheater is a modern recreation of an ancient Roman-style theater and is one of the most recognizable landmarks within the park.

The photographer’s position is at the top of the seating area (the summa cavea), looking southward toward the stage and the mountain range beyond it.

Step 3: Finding the Nearest Cafe

With the photographer’s exact position identified at the top of the amphitheater seating, a proximity analysis is conducted using satellite imagery of Shanadar Park.

A measurement line drawn from the amphitheater seating heading south and southeast, through the park’s wooded interior, leads to a specific establishment located within the park grounds. Based on local business listings and geographic markers in the area, the closest cafe situated along this path, within the immediate park complex, is Lilac Cafe. While other commercial establishments exist in the wider Erbil vicinity, Lilac Cafe is the primary coffee spot that serves the amphitheater and park area directly, making it the correct answer.

A Note on the Travellers Pattern

Across all four challenges, the Travellers group has been photographed at major international landmarks: a college in Ottawa, Canada, a sports arena in Minsk, Belarus, a business district in Brno, Czech Republic, and an amphitheater in Erbil, Iraq. This pattern of high-traffic, globally spread locations is consistent with a group attempting to blend in with tourists and urban crowds while communicating across borders.

Solution

The nearest cafe to the photographer’s position at the Erbil Amphitheater in Shanadar Park is Lilac Cafe.

Flag: SK-CERT{Lilac_Cafe}

---

All four challenges have been solved. The flags, in order, are:

Challenge	Flag
Public Transit	SK-CERT{Point_Island}
Shopping Centre	SK-CERT{Arena_City}
A Little Too Urban	SK-CERT{Alterna_club}
A Beautiful View	SK-CERT{Lilac_Cafe}