enhance(post): finished diver25 posts

Author: Slavetomints

_posts/2025-10-16-diver-osint-ctf-2025-00-engineer.md

@@ -0,0 +1,47 @@
+---
+title: 00_engineer
+date: 2025-10-16
+categories:
+  - Capture The Flags
+  - Diver OSINT CTF 2025
+tags:
+  - ctf
+  - diver osint ctf 2025
+  - osint
+  - writeups
+description: Diver OSINT CTF 2025 00_engineer Challenge
+image:
+  path: /assets/img/diver25/engineer/engineer.jpg
+  alt: a picture of an access badge for a conference
+  post: false
+---
+
+
+> Challenge description:
+>
+>An software engineer's nameplate was picked up near Tokyo Station. This should be a lost item.
+Answer the URL of the website (index page) of the company where this engineer works.
+Flag Format: Diver25{https://google.com}
+{: .prompt-info }
+
+Okay, so lets take a look at the photo that's provided:
+
+![a picture of an access badge for a conference](/assets/img/diver25/engineer/engineer.jpg)
+
+Hmm, well this looks like a classic lanyard and badge for a conference. I bet the name on the badge is actually the person's username on sites like GitHub. Checking there does in fact reveal a GitHub account for one `kodai-sn`.
+
+![the github acount](/assets/img/diver25/engineer/github.png)
+
+Even better, it looks like there a repository named `kodai-sn.github.io`. That's a special repository on GitHub. If you create a website using GitHub pages, it shows up at `username.github.io/repository-name`. However, if the name of the repository is just `username.github.io`, it uses the base URL for the site, making it a good place for a personal website. This blog is served off of [`Slavetomints/slavetomints.github.io`](https://github.com/slavetomints/slavetomints.github.io), and simply uses a custom domain. If you went to [https://slavetomints.github.io](https://slavetomints.github.io) you would also appear here. Neat right?
+
+Anyways, lets check out the website there.
+
+![the personal website](/assets/img/diver25/engineer/personal-website.png)
+
+The part I'm most interested in is the Career section, where they say they've been working for `Magneight Software`. This is probably the company who's website we have to find.
+
+A quick lookup later reveals `magneight.com` to us, and with it the solution
+
+![the company website](/assets/img/diver25/engineer/company-website.png)
+
+FLAG: `Diver25{https://magneight.com/}`

_posts/2025-10-17-diver-osint-ctf-2025-document.md

@@ -0,0 +1,48 @@
+---
+title: document
+date: 2025-10-17
+categories: [Capture The Flags, Diver OSINT CTF 2025]
+tags: [ctf, diver osint ctf 2025, osint, writeups]
+description: Diver OSINT CTF 2025 document Challenge
+---
+
+
+> Challenge description:
+>
+>The US Navy Commander Fleet Activities Yokosuka (CFAY) operates a shuttle bus service between Haneda airport/Narita airport and the base for US military personnel. Answer the name of the person who created the document about the boarding location of the bus in 2023.
+>
+>Flag Format: Diver25{George Washington}
+>
+> https://cnrj.cnic.navy.mil/Portals/80/CFA_Yokosuka/FAQs.pdf?ver=9xaFCoTG0-tMupFtJFmcrQ%3d%3d
+{: .prompt-info }
+
+Okay, quick and easy challenge, my favorite. One thing you might not know about the documents you create is that it generally saves metadata about the document, including the author.
+
+A simple tool to check a file for metadata is `exiftool`. Let's use it here
+
+```terminal
+❯ exiftool FAQs.pdf
+ExifTool Version Number         : 13.36
+File Name                       : FAQs.pdf
+Directory                       : .
+File Size                       : 512 kB
+File Modification Date/Time     : 2023:06:11 23:38:56-05:00
+File Access Date/Time           : 2025:08:27 15:46:53-05:00
+File Inode Change Date/Time     : 2025:06:12 21:04:03-05:00
+File Permissions                : -rw-r--r--
+File Type                       : PDF
+File Type Extension             : pdf
+MIME Type                       : application/pdf
+PDF Version                     : 1.7
+Linearized                      : No
+Author                          : Mitchell.Donovan
+Create Date                     : 2023:06:09 14:02:37+09:00
+Modify Date                     : 2023:06:09 14:02:37+09:00
+Producer                        : Microsoft: Print To PDF
+Title                           : Microsoft Word - FAQs
+Page Count                      : 1
+```
+
+And look at that, right where we hoped for it to be, the author's name.
+
+FLAG: `Diver25{Mitchell.Donovan}`

_posts/2025-10-17-diver-osint-ctf-2025-louvre.md

@@ -0,0 +1,46 @@
+---
+title: louvre
+date: 2025-10-17
+categories: [Capture The Flags, Diver OSINT CTF 2025]
+tags: [ctf, diver osint ctf 2025, osint, writeups]
+description: Diver OSINT CTF 2025 louvre Challenge
+image:
+  path: /assets/img/diver25/louvre/wigle.png
+  alt: list of mac addresses for the SSID Louvre_Wifi_Gratuit
+  post: false
+---
+
+
+> Challenge description:
+>
+>Answer the vendor of one of the Louvre's public Wi-Fi access points that meets the following criteria.
+>
+> - Information was collected on 28 February 2025. This can be accessed via online.
+> - Determine the vendor according to the BSSID.
+>
+> Flag format: Diver25{Company Name} (e.g. If the company is Apple Inc., the flag should be Diver25{Apple Inc.}.)
+{: .prompt-info }
+
+Alrighty, first order of business is figuring out what the public Wi-Fi is for the Louvre. Thankfully, they make that easy for us on their website
+
+>The ‘Louvre_Wifi_Gratuit’ network is available under the Pyramid and in the exhibition rooms. The free Wi-Fi connection last one hour and can be renewed as many times as needed.
+>
+>\- [Do you offer Wi-Fi? - Louvre Website](https://contact.louvre.fr/hc/en-gb/articles/12853523479453-Do-you-offer-WiFi)
+
+Okay okay okay, noow with that out of the way, its time to figure out what the vendor is. The reason we figured out the SSID (name) for the Wi-Fi network is that there are public databases of Wireless Networks. We will be using a site called [wigle.net](https://wigle.net). In order to access the site you need to have an account, but let's see what our search reveals.
+
+![search results](/assets/img/diver25/louvre/wigle.png)
+
+Now, for those of you who don't know, the things on the left most column are whats called MAC addresses. Every single Network Interface Card (NIIC) has one. Every single one is unique, and it consists of two parts. The entire address is 6 pairs of Hexadecimal digits. The first three pairs identify the manufacturer of the device, and the last three pairs identify the unique device.
+
+Thankfully, we can also look that up as well. However, we have two to search for, both `48:C0:93` and `50:60:28`. For this you can use any site of your liking, but I'll use [maclookup.app](https://maclookup.app) this time. Let's see the results for the first one now:
+
+![first mac](/assets/img/diver25/louvre/1-mac.png)
+
+And the second one:
+
+![second mac](/assets/img/diver25/louvre/2-mac.png)
+
+Well wouldya look at that, both MACs are the same vendor, so lets get that flag turned i n!
+
+FLAG: `Diver25{Xirrus, Inc.}`