Private Investigator Walkthrough

An OSINT Investigation challenge solution

Pak Cyberbot

5 min readJun 6, 2024

If you want to solve it before reading the article, check out the TryHackMe room below:

https://tryhackme.com/jr/privateinvestigator

This is the target’s Twitter profile: https://x.com/FlagThief271

Questions:
◾️ 1st Question: mall name
◾️ 2nd Question: IATA code
◾️ 3rd Question : City Name

🔴 More challenges?

1st Question: mall name

First, we need to determine where the target went shopping. The profile image and banner don’t provide much strong information. Let’s investigate the origin of the target’s name, as it might give us specific clues. This name originates from Zulu and African backgrounds, specifically on the South African side. While this information could be helpful, he might be elsewhere.

The first image that the target posted shows him going for groceries before leaving the city.

The red-colored nameplate on top of the building is blurry. Some might deduce exactly what it says, while others may not. A reverse image search could give us the result, but sometimes it can fail. Another trick is to crop that word on the top of the building, sharpen the image through online AI tools, and then put it on Google Image to get that text.

After finding the location of that building, which is Mbabane city in Eswatini, we can check the target’s second post, in which he posted about having food from KFC after doing shopping. We can search for the number of KFCs in this city, which are three, and after that, we can search for ‘grocery store’ in Mbabane as he wrote in his post. One mall was exactly in front of KFC, but for more verification, we can check the street view. The street view image was taken in 2013, while the Twitter post image is more recent. We can see in the Google Maps street view that KFC is under construction for a revamp. We can also see the Mr. Price board on the right-side building, the hills behind the KFC, and even the traffic light matches the exact description as in the posted one. So, we can easily say it’s the exact one, which is “Pick n Pay Mbabane — The Mall.”

2nd Question: IATA code

Now we have to find the IATA code of the airport from which the target departed.

A simple reverse image search of the airport image gives the name of the airport, and we can easily find the IATA code, which is “SHO.”

3rd Question: City Name

In the last post, the target posted an image on 16 Feb that he’s in an airplane. By closely inspecting the image, we can see that it’s Eswatini Air because we checked his country, so we can easily deduce it. Otherwise, we could use AI image sharpening or check all the Eswatini airlines’ names.

After that, we can check his likes section, where we can find that he liked a post by Eswatini Air about a Valentine’s special deal for travel between February 11 to 18. We know that he posted on 16 Feb, so it’s highly likely he availed of this deal. After checking other liked posts, we can see that he liked posts about Zimbabwe, and only one flight in the Eswatini Air deal went to Zimbabwe; the other three were going to South Africa.

As we know that the target mentioned a 1.5-hour flight duration, after checking flight durations, we can confirm it’s going to “Harare.”