Halloween night, I decided to take part in the Haunted Pumpkin OSINT CTF run by OSINT Switzerland, which I had discovered about a week earlier. I had no formal experience with OSINT, but in mixed CTFs, I usually did well on the OSINT‑style challenges, so this felt like the perfect excuse to dive into a fully OSINT event.

I honestly expected to solve maybe the first task and then tap out, so I wasn’t focused on polished writeups or screenshots at the time, but I did keep rough notes of what I tried. The challenges below are the ones where those notes were detailed enough to reconstruct my thought process and show how I approached each prompt during the 30‑hour event.

Ghost ship

I recognised this ship; it had washed up near Cork. A simple Google search for a boat washed up in Cork brought me to Wikipedia, where I discovered it was called the MV Alta. Ghost ship = MV Alta wiki

Ghost ship 2

I already knew the ship’s location, so I just had to find the coordinates; it is off the coast of Cork

Horror Clowns

The goal was to identify which train station appeared in the image.

Horror Clowns was one of the first challenges where guessing clearly wasn’t going to work, so breaking the problem into small OSINT steps helped a lot. Instead of jumping straight to train stations, the workflow looked like this:

1. Identify the original clown video and YouTube creator.

2. Confirm which country the creator is based in.

3. Narrow this down to their home city.

4. List the train stations in that city and compare them with the challenge image.

5. Submit the station that matched as the flag.​​

By following that plan, it was possible to pivot from the challenge image to the creator’s YouTube channel, then to their city, and finally to the local train stations. The second station in that city matched the architecture and layout from the image, so that was submitted as the correct flag

Blair Witch Resident

For this one, the hint was almost in plain sight. Even though the title referenced the Blair Witch and I have never actually seen the film, the image instantly reminded me of it, and the file name BWP pretty much confirmed the direction. I downloaded the challenge image, searched for information about “The Blair Witch Project” and its locations, and focused on the infamous cabin associated with the story. That matched the scene in the picture, so the cabin was submitted as the correct flag.

Helter Skelter

Helter Skelter was the first challenge where trusting instinct almost mattered more than tools. The poem and the eerie image immediately made me think of Charles Manson and the Tate murders, even though I couldn’t explain why at first. From there, I started researching Manson‑related locations: the club he frequented, his home base, the cave,and finally the house of actress Sharon Tate, who was murdered at 10050 Cielo Drive. With only two attempts left, I went with the Tate house as the “brightest star” mentioned in the poem, and that turned out to be the correct flag.

Fake News

For Fake News, the only clue was the edited social‑media style image and the question “Can you find out who was actually arrested here?”. The first step was to screenshot the challenge image and run it through Yandex reverse image search to hunt for the original, unedited photo. Using details like the black Nike jumper and the man in the blue shirt and mask in the background, it was possible to match the scene to a real news article about an Apple executive being arrested. From that article, the real person’s name became the flag in the format requested by the challenge.

Fake news 2

For Fake News 2, the hard work was already done in the previous challenge. Now that I knew who had been arrested, the prompt asked: “Can you also find which age Ryan was when he was arrested?”. I took his full name, searched it together with the word “arrested” in Google, and used Google’s AI answer box to pull out the age given in the article. That age was submitted as the flag

Dude where is my car

For this challenge, I was given the YouTube trailer for The Car (1977). Even though I have never seen the film, I had fun with it because I recognised the vibe from the Futurama episode where Bender turns into a car. While watching the trailer, the key detail that stood out was the tunnel shot, so the first step was to identify the tunnel’s name using Google.​​

Once I had the tunnel name, I switched to Google Earth, navigated to the tunnel, and followed the road until I found the nearby public toilets with the green roof. From there, the challenge turned into a slow grind of reading every visible roadside sign in very blurry Street View. I tested speed limits of 40 and 30 first with no luck, kept scanning the area, and finally spotted a small sign showing a 25 speed limit. That “25 mph” detail was the correct flag.

I like Trains

I Like Trains started with a single still image taken of the front of a bright red train, which at first glance looked like someone’s red shoulder rather than the front of the train. To get more context, I used Google reverse image search on the picture and eventually matched it to a specific Swedish train model. With the train’s name identified, I searched for videos of that model on YouTube and watched until a side view appeared that clearly showed its identification code. That visible code on the side of the train became the flag for this challenge.

Trash belongs in the bin

This challenge came with a short riddle and a suspicious‑looking string: “Look what someone threw into the bin: 6W2XQjJP”

Trash Belongs in the Bin hinged entirely on recognising what kind of “bin” the challenge was hinting at. The string 6W2XQjJP looked like an ID, so it was tried directly on Pastebin as /6W2XQjJP, which loaded a paste containing a suspicious hash value. That content was fetched with curl for convenience, and the hash was then submitted to VirusTotal for analysis. The VirusTotal report showed a malicious file named jigsaw.exe, and that filename was used as the flag for this challenge.

The End

I finished the event in 68th place with a total of 3101 points, which was much higher than expected for my first pure OSINT CTF and definitely motivated me to keep grinding these challenges.