│ Category: OSINT
│ Author: Imattas aka Zemi
│ Flag: byuctf{El_Salvador:10}
│ Source Path: osint/under_the_overpass
────────────────────────────────────────────────────────────────────────────────
--[ Challenge Description ]--
-- text --
We have reports that an international spy, traveling under the name Cameron Joseph Snider, may be attempting to sell government secrets to a foreign government. His passport recently got pinged attempting to enter Germany, and we believe he is currently in Berlin attempting to meet his contacts at a foreign embassy. We need you to find out what country's embassy he is visiting, as well as how many security cameras are within 100 meters of this embassy.
His last emails mention having a bad toothache, and needing to schedule a visit with the dentist's office next door to the embassy he is at. He is also staying at a hotel that is on the other side of the embassy.
To help you find him in time, we are giving you special access to a secret government program. Good luck.
https://overpass-turbo.eu/
Flag format: `byuctf{Country_Name:Number of Cameras}`
Example: `byuctf{France:59}`
────────────────────────────────────────────────────────────────────────────────
--[ Provided Materials ]--
- Repository folder
https://github.com/BYU-CSA/BYUCTF-2025/tree/main/osint/under_the_overpass
- osint/undertheoverpass/README.md https://github.com/BYU-CSA/BYUCTF-2025/blob/m
ain/osint/under_the_overpass/README.md
────────────────────────────────────────────────────────────────────────────────
--[ Recon / Initial Analysis ]--
This page imports the BYUCTF 2025 source material for the OSINT challenge Under
the Overpass. The prompt is kept separate from the solve notes, and upstream
artifacts are linked so the challenge can be replayed from the original
repository.
────────────────────────────────────────────────────────────────────────────────
--[ Vulnerability / Observation ]--
The useful observation comes from the imported solve notes below. I kept the
original technical path intact while normalizing the page metadata, challenge
grouping, and author attribution for the Volume 2 writeup archive.
────────────────────────────────────────────────────────────────────────────────
--[ Exploitation / Solution ]--
Source: osint/undertheoverpass/README.md https://github.com/BYU-CSA/BYUCTF-2025/
blob/main/osint/under_the_overpass/README.md
1. First, we need to craft an Overpass Turbo query to find all diplomatic
offices in Berlin:
-- json --
[out:json][timeout:25];
{{geocodeArea:Berlin}}->.searchArea; (
nwr["amenity"="embassy"](https://github.com/BYU-CSA/BYUCTF-2025/blob/main/osint/under_the_overpass/area.searchArea);
nwr["office"="diplomatic"](https://github.com/BYU-CSA/BYUCTF-2025/blob/main/osint/under_the_overpass/area.searchArea); ); out
center;
2. Looking for an embassy next to a dentist office gives us the embassy for El
Salvador.
3. Finally, creating a query to give us every security camera within 100 meters
of this embassy returns 10 cameras:
-- json --
[out:json][timeout:25];
// Search for surveillance devices within 100m of
given coords
(
nwr(around:100, 52.5287089,
13.3800402)["man_made"="surveillance"];
nwr(around:100, 52.5287089,
13.3800402)["surveillance"];
);
out body;
Flag - byuctf{El_Salvador:10}
────────────────────────────────────────────────────────────────────────────────
--[ Full Exploit Script ]--
No standalone exploit script was present in the selected source material.
────────────────────────────────────────────────────────────────────────────────
--[ Key Takeaways ]--
- The BYUCTF 2025 challenge material is preserved with local archive formatting.
- The page author is normalized to Imattas aka Zemi.
- The source repository remains linked for handouts, services, and solve
artifacts.