Jasper Alblas
TryHackMe: Searchlight – IMINT Walkthrough
Welcome to this walkthrough of the Searchlight Room on TryHackMe. In this room we will be looking at OSINT challenges in the imagery intelligence category. This fits me wonderfully, as I have a background within GIS / Remote Sensing. Let’s see if that can help me 🙂
Room URL:
https://tryhackme.com/room/searchlightosint
I am making these walkthroughs to keep myself motivated to learn cyber security, and ensure that I remember the knowledge gained by these challenges on HTB and THM. Join me on learning cyber security. I will try and explain concepts as I go, to differentiate myself from other walkthroughs.
Table of Contents
Task 1: Welcome to the Searchlight IMINT room!
n this room we will be exploring the discipline of IMINT/GEOINT, which is short for Image intelligence and geospatial intelligence. This room is suited for those of you who are just beginning your OSINT journey or those brand new to the field of IMINT/GEOINT.
This room will introduce you to several topics within IMINT, among them:
- Getting into the right mindset and how to be analytical
- Visually extracting key data points from an image or video
- Applying different tools to assist you in geolocation and answering context questions
When you have completed this room you should be comfortable applying tools and methodologies to geolocate and answer context questions based on visual intelligence alone. This room will prepare you for harder CTF challenges in this category as well as real-world geolocation work.
Any thoughts, feedback or issues can be forwarded to me directly on the THM or OSINT Curious Discord. You’ll find me there as zewen.
The flag format is: sl{flag}. This means that every answer needs to be submitted within the brackets, sl{your answer}. No capitalization is needed.
The answer to the question below is: ready.
Questions
Did you understand the flag format?
Are you ready? I sure am !
Answer: sl{ready}
Task 2: Your first challenge!
Your first geolocation challenge!
Let’s introduce you to your first tool – your eyes!
Before we can apply a tool or a methodology for finding the location of an image, we should use our eyes to scan the image for important information. Extracting key data points from the image will allow you to apply the right tool, craft a good Google search or identify which part of the world the image might have been taken in.
There are 5 elements of IMINT that you should consider when looking at an image, according to Geoint expert Benjamin Strick:
- Context
- Foreground
- Background
- Map markings
- Trial and error
A geolocation challenge like this lacks one important factor, which is the context or the source of the image. In real-world cases, you usually have a context in which the image was produced or shared, usually called context clues. Most of these challenges will not have context clues but you may find clues in the titles and descriptions, or if you’re stuck you can use the hint function.
Here are some questions you should ask yourself while looking at the upcoming challenges:
- Are there any obvious data in the image that reveals the location, like a street name or storefront signs?
- Can you determine the country or region of the image by, for instance, which side of the road they drive on, language or architectural characteristics that may reveal a country or continent/region?
- Do you recognize road sign styles, nature and environmental characteristics, or popular motor vehicle brands or vehicle types?
- What is the quality of any visible infrastructure like? Is the road paved or do you see gravel roads?
- Do you see any unique landmarks, buildings, bridges, statues or mountains that can help you geolocate the image?
Download the attached image and answer the question below – good luck!
Questions
What is the name of the street where this image was taken?
Ok! Let’s start looking at the image:
We see some kind of shopping street, in a European looking city. The houses are in different colours, but the most dominant other feature is of course the curved sign hangning above the street saying “Welcome to Carnaby Street”. This tells us many things. We know we probably are in a English speaking country. But this also gives us a specific street. Other feature of note are the Makeup Store and the Fornarina shop. We can also see a sign of the street intersecting Carnaby Street. This one is hard to read though.
While we could reverse image search, we can simply google the sign name to find more info on Carnaby Street
We already have the answer to the question, but let’s try and find the exact location. This Instagram post seems to indicate that the Fornarina shop is closed:
https://www.instagram.com/__dreamspaces/p/CnkRbJNtnSK/?ref=updates.kickstarter.com&img_index=1
But through Yelp we seem to get be able to get an old address:
https://www.yelp.com/biz/fornarina-london
30/31 Carnaby Street
London W1F 7DJ
United Kingdom
This brings us here:
And sure enough, even though some colours and signs have changed, this seems to be the location:
Answer: sl{Carnaby Street}
Task 3: Just Google it!
The last challenge wasn’t really a challenge, was it?
Let me introduce you to your first tool, Google! If you see anything in the image that can be extracted into a keyword, phrase, a company name, telephone number or any other question you may have as a result of scanning the image up and down: GOOGLE IT!
Here is a short introduction to what we call ‘dorking’, the art of using Google search queries to have Google return specific types of data. The next challenges will require you to do some basic Googling in order to answer the questions. You can also practice dorking by joining the Google Dorking room.
When geolocating a picture finding the exact location is key, but we may need to answer other questions about the location or the image as well, usually referred to as context questions.
The next few challenges will ask multiple questions that you need to answer based on the information you extract from the image.
Questions
Which city is the tube station located in?
Let’s have a look at a new photo:
Most of you will immediately recognise the location as the entrance to the London Underground. The question is which station this is. But for this question London is enough 🙂
Answer: sl{london}
Which tube station do these stairs lead to?
Hmm! We could definitely do some kind of reverse image search as the background buildings are pretty distinctive. But this task wants us to Google things so have a closer look!
Right below the surface level there is actually a tube station name, but we can only read “..LY CIRCUS ST..”. We can assume that it ends with station, now let’s just google the part of the name we have:
https://www.google.com/search?q=ly+circus+st
We get shown the following Wiki page:
https://en.wikipedia.org/wiki/Piccadilly_Circus_tube_station
And sure enough, if we look at images for this station we can see this is correct, although the angle is slightly different.
Answer: sl{piccadilly circus}
Which year did this station open?
We can refer back to the Wikpedia page, and here it mentions that:
The station was opened on 10 March 1906 by the Baker Street and Waterloo Railway (now the Bakerloo line) with the platforms of the Great Northern, Piccadilly and Brompton Railway (now the Piccadilly line) being opened on 15 December 1906.
Answer: sl{1906}
How many platforms are there in this station?
We are lucky – this information can also be found on the Wiki page:
Answer: sl{4}
Task 4: Keep at it!
Good job solving the last challenge! You were able to find the location of the image and by doing that, you could answer contextual questions about the location. This challenge will also require you to do some ‘Google dorking’ to answer the questions below.
Scan the image for data and remember the questions from the introduction – Do you see anything in the image that can be used in a search query or help you narrow down the potential location?
Questions
Which building is this photo taken in?
Let’s have a look at the photo:
Let’s talk about what are a seeing. This looks like a canteen of sorts. It could technically also be a restaurant, but we see a large open area which lots of tables and chairs close to each other. In addition, there are waste sorting bins. I am going to assume for now that this is a school or restaurant, but I might be wrong of course. At least it seems to be a place where people can have a quick bite. At this point it is just about narrowing the kind of locations we are searching for.
Of special interest is the sign in the background, which clearly says YVR CONNECTS. Hmm, might it be transport related? Let’s google on the text shall we?
https://en.wikipedia.org/wiki/Vancouver_International_Airport
Aaaand I was wrong. This is not a school, but rather an airport. After a second look, we also see a person in a neon traffic vest in the back, which also points to an airport I suppose. Anyway, we found the correct answer!
Answer: sl{vancouver international airport}
Which country is this building located in?
Vancouver is the third largest city in Canada.
Answer: sl{Canada}
Which city is this building located in?
HAH! I thought I was being clever and assumed this was Vancouver. But airports are often located outside of the cities they are serving, as is the case here as well.
Answer: sl{richmond}
Task 5: Coffee and a light lunch
Now that you’ve started to learn some techniques I figured we could try and do some good while we hone our skills.
A friend of mine contacted me asking if I could help them locate a coffee shop that is supposed to serve the best lunch there is. They told me the coffee shop is somewhere in Scotland, and he sent me these two pictures. Do you think you could locate it and answer the questions below for me?
Questions
Which city is this coffee shop located in?
YAY. Let’s have more fun. All we know is that we are looking for a coffeeshop somewhere in Scotland. Well, maybe we can find more hints from the 2 photos?
Let’s take this photo first. We see a tables with 3 chairs, and interestingly, they have a windows view towards a shop called The Edinburgh Woollen Mill. Might we conclude that this coffee shop is located in Edinburgh? Before moving on, we can not that it seems like the coffeeshop is located at an intersection with regular concrete roads, and we might be able to use the traffic sign to help geolocate the exact location.
Before answering the city question, let’s look at the second picture.
We see some people eating some lunch, which by the looks is very English. I am not sure what more to see in this photo, but maybe we can identify the photo on the coffee bars website later?
I tried answering Edinburgh, but hey! We are not so lucky this time! The Edinburgh Woollen Mill is a huge franchise, and they have stores a ton of places:
https://www.ewm.co.uk/store-finder
But if we search on Google Maps, luckily there are not that many stores in Scotland:
It is time for some manual labor. In this case it is ok to check the 8 locations, to see if we can see a location that matches our photos. On a closer look, some of the locations are outside of towns and the picture we see definitely appears to be in a town. In addition, we can see on the photo that the shop is on a corner.
The only shop that is close to matching is the following one in Blairgowrie:
Note the traffic sign in front of the shop:
Now all we need to do is find the coffee shop, estimated to be on the opposite side of the intersection.
If we line up the view from the coffee shop at a similar angle as on the photo we can see that the coffee shop is called the Wee Coffee Shop:
Note the two papers on the right window, on the left side from the inside. Just as in the photo we received. In addition, the wall inside looks similar (brown in the bottom, and lighter in the top, divided in the middle). This must be the place!
Let’s get to answering some of these questions. The city name is Blairgowrie.
Answer: sl{blairgowrie}
Which street is this coffee shop located in?
See the above picture. The street name is Allan Street.
Answer: sl{allan street}
What is their phone number?
We can find the phone number and email address on their Facebook page:
https://www.facebook.com/weecoffeeshop
Answer: sl{+447878 839128}
What is their email address?
This is also found on their Facebook page.
Answer: sl{theweecoffeeshop@aol.com}
What is the surname of the owners?
I took a look at the TripAdvisor page:
Here I actually found the two pictures that we received from THM. But I did not find any names. Some more searching:
https://www.barba.org.uk/blairgowrie-and-rattray-businesses/the-wee-coffee-shop
Here we can read that Debbie and David Cochrane own the business.
Answer: sl{Cochrane}
Task 6: Reverse your thinking
One of the methods for geolocating an image is to do an image reverse search. This means that we are searching for the image itself online, and if the image has been indexed by search engines we may find the exact image or we can do a visual search or crop search to help us find similar images.
Aric Toler from Bellingcat has written a fantastic guide on reversing images, please read it here. OSINT Curious also has a write-up on the topic that you should look through before attempting this challenge.
I recommend adding this extension to ease the workflow for when you find images online that you want to do an image reverse on:
Addon description: “Perform a search by image. Choose between the image search engines Google, Bing, Yandex, TinEye and Baidu.”
Chrome: RevEye Reverse Image Search
Firefox: RevEye Reverse Image Search
Remember that changing the crop and the keywords for searching an image may yield completely different results.
Questions
Which restaurant was this picture taken at?
First, make sure you read the two articles mentioned in the text. Now let’s have some practice reverse image searching this picture:
As Yandex seems to be the most accurate reverse image search tool, let’s try searching there. Well, look at this:
There are a ton of results. Nearly all show a restaurant, with multiple lines of lamps on the ceiling, hanging cutout circles, and walls filled with picture frames — this seems legit. The name that’s mentioned a bunch of times is Katz’s Delicatessen — NYC’s oldest deli, or simply Katz’s Deli.
Answer: sl{katz’s deli}
What is the name of the Bon Appétit editor that worked 24 hours at this restaurant?
A simple google search on bon appétit katz’s deli lead me to the following video:
The answer can be found at the 0:27 timestamp – Andrew Knowlton.
Answer: Andrew Knowlton
Task 7: Locate this sculpture
This challenge will require you to apply some the techniques I have touched on so far: Scanning the image for visual clues, reverse image searching and Google dorking. Tools should not be your primary focus – don’t underestimate how far you can get with dorking and scrolling search results.
Questions
What is the name of this statue?
You know the drill – let’s look at another photo:
Let’s discuss the photo first. In the foreground we some kind of statue, which is a mixture between a motorcycle and deer. It seems to be made out of metal. In the background we see some kind of large apartment complex.
I think we could easily find it by reverse image searching, but I suppose we could easily google it as well. Let’s try both. Searching for statue deer motorcycle brings us a bunch of useful results:
https://www.flickr.com/photos/albategnius/26811618542
This even gives us a location: Aker Brygge, Oslo at the Tjuvholmen Sculpture Park. But no name yet. But sure enough, other search results give us the name:
Answer: sl{rudolph the chrome nosed reindeer}
Who took this image?
To find this specific image’s photographer, we probably would do best to reverse image search. Let’s try Yandex. This did not return any interesting results, except for a lot of THM walkthroughs heh!
If you search for rudolph the chrome nosed reindeer though and look on page 2 of the results (in my page), you will get to the following visitoslo page:
https://www.visitoslo.com/en/articles/outdoor-sculptures-in-oslo
If you find the statue on the map in Tjuvholmen, you end seeing more info on the statue and this specific picture.
The photographer is right there in the image credits. I still feel it is weird though that I could not find this url through a image search on Yandex, Bing and Google 🙁
Answer: sl{kjersti stensrud}
Task 8: …and justice for all
This challenge is a step up in difficulty from the previous challenges and you shouldn’t expect to solve this quickly, especially if you are new to IMINT. While you can certainly apply the techniques and tools you’ve used to s far, this challenge may force you to revise your thinking and your approach while you’re working on solving this challenge.
I highly recommend watching this Ted talk by Amy Herman on visual intelligence: “A lesson on looking” if you want a unique view on how you perceive visual data.
Questions
What is the name of the character that the statue depicts?
Let’s start once again by looking at the photo:
It immediately made me think of Daredevil, but that is mostly because because I just ended up binging it and the figure looks like the statue in the Daredevil intro. Ugh, sorry. I will get back on track!
We see some kind of “justice” type of lady, whom is blindfolded. The statue seems to stand of some kind of building with large windows. In the windows we see reflected something that looks like an apartment complex.
We don’t have an obvious term to google search on here, so let’s try a reverse image search on Yandex:
Yandex brings us close to an answer. The lady on the statue is Themis. Which according to other sources (https://en.wikipedia.org/wiki/Themis) also commonly is called Lady Justice.
Answer: sl{lady justice}
Where is this statue located?
The Google image search results were more useful here, but still a lot of results seem to come from news articles that simply use this statue as some kind of stock photograph for justice related news. Anyway, after some scrolling I found the following article:
Here they mention the following about the statue: A statue of the Scales of Justice casts a shadow on the Albert V. Bryan US Courthouse.
More info on this courthouse can be found here:
https://en.wikipedia.org/wiki/Albert_V._Bryan_United_States_Courthouse
And sure enough, this seems to be the place:
The answer expects the geographic location, in this case Alexandria, Virginia.
Answer: sl{alexandria, virginia}
What is the name of the building opposite from this statue?
This should be easy enough. Look for the location on Google Maps:
Let’s stand right in front of the Courthouse in Google Streetview:
And turn around:
We will see a 4 stars hotel right opposite of it, the building in the reflection of the original photo. The hotel is called The Westin Alexandria Old Town.
Answer: sl{the westin alexandria old town}
Task 9: The view from my hotel room
Geolocating videos aren’t much different from geolocating images. A video is just a string of images, usually played at 24 frames(or images) per second. In other words, a video will hold a whole lot more images that can be analyzed, reversed and scrutinized by you.
Here’s a good writeup by Nixintel on a tool called FFmpeg, which will help you extract the key images from the video that you may need to solve this challenge. Download the attached video and follow Nixintel’s guide!
You may have to apply other tools to solve this challenge as well!
Questions
What is the name of the hotel that my friend stayed in a few years ago?
Go ahead and download the video clip. Now make sure that you have FFMPEG installed on your system. I will run the following command to create stills from the video:
ffmpeg -i task9_1602643917499.mp4 img%06d.png -hide_bannerI do recommend to use the -r flag as well, as this way you can adjust the number of pictures that get generated. I ran it without and ended up with 1425 pictures!
ffmpeg -i task9_1602643917499.mp4 -r 1 img%06d.png -hide_bannerThis way we only get 1 frame for every second of the clip, in this case 49 pictures.
Let’s have a look at some of the pictures, which I feel have some distinctive features that can help identify the place:
This is basically the general look from the hotel. We see a lot of remarkable features, including the three-tower building in the background, but also see some kind of covered market in the foreground, a building with a sign saying “central”, colourful buildings on the left, and finally a large ferris wheel in the complete back to the left. Many of these features alone will probably be enough to geolocate the area.
Looking from the balcony towards the left there seems to a high area which looks like a park. Also note the wall of the hotel which is orangish with a special pattern. Finally, there are a lot of high buildings in the horizon. To the right side there is water, some boats, and a distinctive Riverside Point building.
We see a bunch of colourful warehouses on the street in front of the hotel room. In addition a bunch of busses, so maybe a quite touristic place?
We also see a large covered area, maybe looking like some kind of market?
We see a canal, and a building with a glass roof with a large sign saying RIVERSIDE POINT.
A hotel like building with a large sign. It definitely says CENTRAL, and on the left it says…I think clarke quay?
Very distinctive building, with 3 highrises connected by a platform.
Finally, a ferris wheel in the back.
Well..we have a ton of useful info! We already found the Clarke Quay name, which after a quick search is a popular area in Singapore. Simply searching for Riverside Point will have brought us to the same area. Riverside Point is a large shopping mall in the same area.
A quick look at this map shows us the river, a large green area and generally, this definitely seems like the right place. It didn’t take me much time either to find the name of the high-rise with three towers:
https://en.wikipedia.org/wiki/Marina_Bay_Sands
I also tried reverse image searching the colourful warehouse type buildings These can also geolocated at this area:
https://www.flickr.com/photos/shootsgp/41889187441/
I even found this result:
https://www.alamy.com/marina-bay-sands-and-clarke-quay-view-from-novotel-hotel-singapore-image351448166.html
This seems like the same view and here they mention the hotel called Novotel Hotel, Singapore. Now that I have proven the location of the area let’s try an confirm is this is the right hotel. Reverse image searching the first image brings me to the following review of the same hotel (Novotel Clark Quay Hotel):
https://javamilk.com/2013/05/20/review-novotel-clark-quay-hotel
Searching for this hotel though, shows that is permanently closed:
If we assume the balcony in the video is pointing in the south-eastern direction, we can also see that it matches with the view towards the right towards Riverside Point, and also that the guest was able to see Clarke Query Central. In addition, there are the warehouse like buildings in front of the closed hotel.
When looking at the location on Google Streetview the building does not exist, which did make finding the building slightly more tricky.
Originally I thought the hotel had not been built yet because the pictures maybe were to old. But actually the picture are from 2024, so this means the hotel has been demolished!
Answer: sl{Novotel Singapore Clarke Quay}
Congratulations on completing Searchlight – IMINT!!!
Congratulations on completing the Searchlight – IMINT room. This is one of my favourite rooms on THM so far. I loved how it introduced some IMINT concepts, followed by challenges which gradually increase in difficulty.
Come back soon for more walkthroughs of rooms on TryHackMe and HackTheBox, and other Cybersecurity discussions.
Find my other walkthroughs here.
Like my articles?
You are welcome to comment on this post, or share my post with friends.I would be even more grateful if you support me by buying me a cup of coffee:
I learned a lot through HackTheBox’s Academy. If you want to sign up, you can get extra cubes, and support me in the process, if you use the following link:
