In this walk through, we will be going through the Geolocating Images room from Tryhackme. In this room, we will learn and perform Geolocating images using OSINT. So, let’s get started without any delay.
Table of Contents
Task 1 – Getting Started
Question 1 – Download the zip file
Done
Task 2 – Getting our feet wet – where is this?
Question 1 – Where in the world is image 1? The answer is the country name.
- I uploaded the image to Yandex reverse image search.
- Found this one in the similar pictures result. In the picture, there is some sort of a board in which “The Oilwell No. 1 in Karamay” is written.
- Searched for “Karamay” online confirmed that it is a city from Northern China.
China
Task 3 – Geolocating Images 101
Okay, now we know what reverse image searching program to use. Let’s try to actually look at the picture now to figure out where it is!
Let’s say we have a webcam we found on Shodan.io:
https://padcam.liverpool.ac.uk/cgi-bin/guestimage.html
Where is this camera?
The first thing we notice is the weird crest & title with a black bar (and possibly text) underneath it.
Second thing is the logo, “Kaplan”.
The third thing is that there is a glass building next to a concrete building.
And finally, we have what appears to be a highway next to the glass building. Because it’s a webcam, we can see cars moving quickly!
Putting this into a reverse image search program shows nothing.
Now, something important to note is the name of the webcam. The URL points to Liverpool.ac.uk, which is a university in Liverpool.
If we just had an IP address, we could try to geolocate it using an online tool, checking the ASN number or finding it on Shodan.
Googling “Kaplan University of Liverpool” leads us to a news article about a new building. If we take a look at the image, it looks approximately similar to the one we saw.
Rows of long glasses with a little bit of overhang.
Luckily for us, Liverpool have captioned the image.
"The proposed new Liverpool International College facility"
If we google Liverpool International College we get:
Which is our building! But it’s not built yet… What gives?
In the bottom right hand corner, Google tells us the image was captured in June 2019.
So Google maps hasn’t updated yet.
If we turn the camera around on Google maps, we can see where the live webcam should be.
Somewhere on this building!
When geolocating an image, we want to point out big landmarks we can easily find on a map. Road layouts, business names, The Empire States Building.
Task 4 – Now your turn
Where was image 2 taken? Specifically, I’m looking for the name of the place that has likely set up the webcam. You’ll know it when you see it!
Please do not use reverse image searches for this!
Question 1 – Where was image 2 taken?
- As per our picture, we can see three signs clearly – Sheffield, Addison Street and Sports Corner.
- I googled for “Addison street Sports Corner” and found our Spots corner bar.
- Further looked into the location using Google Street View images and found our spot at the opposite direction from our Sports corner bar banner.
Wrigleyville Sports
Task 5 – Helpful tips for geolocating
Question 1 – Read the above material
Done
Task 6 – Your turn, again!
Question 1 – Where was image 3 taken?
- This image was harder to crack as compared to the previous ones. I used to try various locations like cemetery, mosques and other buildings that has a dome like structure however didn’t got any success.
- I tried “Observatory in Paris” and found a picture in the related images where it was tagged as “Meudon Observatory”.
Meudon Observatory
Task 7 – Your turn, what can you see?
Question 1 – Where is image 4 taken?
- The target image seems to be belong from London, There is a pedestrian crossing and a tower like monument in the middle. Along side the road, there are poles with yellow light on them. On googling, i found out that these are called Belisha Beacons. The wall has some scribble on them with a name, maybe Jerry.
- I was not able to deduce the location from the things in the images. So used Yandex reverse image search and got the below one in similar images. The description says – “Abbey Road Camera”.
Abbey road
Task 8 – You’re done!
Also Read: Tryhackme – Corridor
So that was “Geolocating Images” for you. In this room, we learned about geolocating images using OSINT. Then, we performed OSINT on 4 target images and confirmed their location where the image was taken. On that note, i would take your leave and will meet you in next one. Till then, “Happy hacking”.
