Golden Hour - (OSINT)

Challenge Overview

"I never delete, I just stop pointing. Everything I walked away from is still out there, and the one thing worth keeping, I locked. The key's already yours."

The brief is a set of OSINT hints in disguise: "I never delete, I just stop pointing" (old commits/handles still exist, they're just unlinked), and "the one thing worth keeping, I locked... the key's already yours" (there's an encrypted vault whose passphrase is recoverable from public breadcrumbs). This is a person-pivot challenge: follow one identity across platforms, collecting clues until the vault opens.

---

Step 1: The Portfolio

The site is the personal page of Nova Keller, a game dev / film photographer. The nav has Work · Journal · Code · Contact.

The useful pivot is Code, which points to a GitHub profile: github.com/nova-drifts.

---

Step 2: GitHub → the driftlog Repo

nova-drifts has five public repos. The one that matters is driftlog ("personal site, built in the open").

Remember the hint, "I never delete, I just stop pointing." That's a nudge to read the commit history, not just the current tree. A commit (tagged backup-2024) adds three files, and humans.txt is the prize:

Nova Keller
# socials draft - decide which handle I am actually keeping
linkedin: https://www.linkedin.com/in/nova-drifts/
linkedin: https://www.linkedin.com/in/nova-keller-/

Two LinkedIn handles, one a decoy. Checking both, only nova-keller- actually exists. This is a core OSINT skill: when a target has multiple candidate accounts, verify which are live rather than assuming.

---

Step 3: The LinkedIn Profile (Leet + Base64)

The real profile is seeded with clues written in leetspeak:

• Headline: N0V4 K311ER → Nova Keller
• About line: y0u n33d 70 r34d 7h15 → you need to read this
• A Base64 blob: eTB1IDRyMyA0bG057CgN2gzcjM=

Decoding the Base64 (CyberChef → From Base64) gives another nudge:

y0u 4r3 4lm057 7h3r3   →   you are almost there

It also tells us the profile's phrase "Keepers in the vault, not the feed" is pointing at an actual vault.

---

Step 4: The Vault (passphrase, step 1 of 2)

The challenge site has a hidden page, /drop.html — "THE VAULT · LOCKED", which decrypts in-browser once you supply the right passphrase.

The passphrase is the last encoded breadcrumb from the trail, a Base32 string. Running it through CyberChef (Magic / From Base32):

MRZGSZTUO5XW6ZA=   →   driftwood

Entering driftwood advances the vault to step 2 of 2.

Encoding recap for this challenge: the site/profile layered Base64 (ends in =, mixed case) and Base32 (A–Z + 2–7, also = padded). Recognising which is which by its alphabet is half the battle, Base32's all-caps + digits-2-7 look is the giveaway.

---

Step 5: Geolocate the Photo

Step 2 shows a sunset photo of a lighthouse on bare granite and asks you to name the place.

This is classic image geolocation. The distinctive red-and-white lighthouse on smooth wave-washed granite with no trees is Peggy's Point Lighthouse at Peggy's Cove, Nova Scotia — one of the most photographed lighthouses in the world, which makes it recognisable by reverse image search or just by eye.

There's a nice thematic wink here too: the photographer is "Nova," the location is Nova Scotia, and the eventual flag is about drifting home.

Entering peggyscove unlocks the vault.

---

Step 6: Full-Res Photo → EXIF → Flag

The unlocked vault offers the full-resolution image for download, with a telling line: "a good photo carries more than the pixels."

That's a direct hint to inspect the metadata. Running golden-hour.jpg through an EXIF viewer (ExifTool / any online metadata tool):

The UserComment EXIF field holds the flag:

KPMG_CTF{n0va_dr1ft3d_h0m3}

---

Summary

Key Takeaways

• Follow the person, not the page. The whole challenge was one identity (Nova Keller) scattered across a portfolio, GitHub, and LinkedIn. OSINT is about chaining a single thread across platforms.
• History is forever. "I never delete, I just stop pointing" = orphaned commits and old handles still live in git history and on the platforms. humans.txt was only reachable by reading the commit log.
• Validate candidate accounts. Two LinkedIn URLs were given; only one existed. Always confirm which sock puppet is real instead of trusting the first link.
• Know your encodings by their alphabet. Base64 (A–Za–z0–9+/=) vs Base32 (A–Z2–7=) look different; spotting which is which immediately tells you how to decode.
• Geolocation is an OSINT core skill. A well-known landmark (Peggy's Cove lighthouse) is identifiable by sight or reverse image search.
• Metadata carries secrets. "A good photo carries more than the pixels" = check EXIF. The flag sat in UserComment, a field most viewers never look at.

Flag: KPMG_CTF{n0va_dr1ft3d_h0m3}