What’s that about ? #
The THCon (Toulouse Hacking convention), is a French cybersecurity conference that brings together hobbyists, professionals and researchers every year at Toulouse in April-May.
This edition (2026), I was the challenge lead, and also created a few challenges including an 8-part geoINT challenge (like last year !) which this article is about.
Note : in the case the CTFd is not up anymore, if you did not participate, or you don’t remember the challenges you can take a look at https://ctftime.org/event/3186/tasks/ although not all of them may be listed sadly :/
Let’s get to the writeups #
Easy #
These first challenges were meant to be accessible.
1 Search for the bridge #
The first chall involved searching for a well known bridge in France. For those not knowing it already a simple reverse search was sufficient (e.g. using Search By Image). No real issues there, the boat the picture is taken from gives us the exact location since there is a dock shaped like a “T”.
2 Reverse search the right part of the Church #
The second chall needed you to do a basic reverse search to get the name of the building right behind you (Église Ste Blandine in Lyon, France). The issue here is that the church is quite common (gothic facade, nothing out of the ordinary) so one had to focus on specific parts like this :
This Tympanum depicts St Blandine (a 2nd century slave who died a martyr in Lyon and is the patron saint of Lyon) and is unique to this church, making it easy to find.
3 Find the rest area in the middle of a highway #
This third challenge has a road sign that indicates highways rest areas. Both the sign and language point to a french highway and a search for “Aire de Bellevue” yields only two results :
Checking 300m away from each we can find this sign although the picture having been taken a few years ago the trees are cut and planted again. Always be careful, geography is something that can change quite fast.
Medium #
These challenges were meant to be doable with basic OSINT tools and mindset.
4 Can I get a Craftman on the phone ? #
The fourth challenge brings us on a 2 + 1 road that looks like a “Nationale” or “Régionale” road (not a highway but still a major road). We see that there is a sign next to the road that has a readable phone number on it. With this phone number we can find the Rocher Terrassement company, which is lotated at 165 CHEMIN DU MOLLARD ROND, 38140 RENAGE.
When looking this address up we can see that there is a major road next to it (red) but also a hughway. Since we already ruled out highways e can check the major road.
At this point we only need to move along the main axis to find the place. Note that for those using google maps the sign is not there since the last google maps picture was taken in 2022 and our challenge’s picture is more recent.
5 Wait another bridge ? #
This challenge had a white bridge in the horyzon. It is a white and Cable-stayed bridge that either by knowing it or with a reverse search turns out to be the Viaduc de Millau (the world’s second largest bridge of that type).
Since this bridge goes north to shouth and we are seing it from the side we can easily pinpoint where we may be. As we are looking at it from a roughly 45 degree angle and we are on its left when aligning with is we are either north-east of it or south-west of it :
Looking at the picture there seems to be vast fieldsand a big city which fits the north-eastern part (big agricultural fields, and the city of millau) but does not fit the south-western.
After that all we need to do is to look for a turn with a smaller path joining the main one. the road is wide enough that it’s probably a major road, so we can start by checking the only “départementale” for turns that bend away from the bridge.
Hard #
These ones are the real interesting challenges (except for the group that randomly clicked on the map and “Oh that’s it”).
6 Overpass this bus stop #
The idea of this challenge is easy actually (yes, really), the hardest part is the execution. You can find based on the look ofthe bus, it’s identification numbers or reverse searches around on the image that it is in Lyon, France (like challenge 2). This however is not enough since there are a lot of busses in Lyon, it being France’s second largest city. Long but still doable :
One way to solve this one was to look for bus stops (marked by the yellow lines on the ground) near at least 1 bench, one dust bin and 2 recycling containers (once being for glass, the other for clothing) . There is not a lot of them in Lyon. A creative solution was to find thebus line associated with this bus and follow it (still took about 10-15 mn).
Here is the request for you overpass fans :
[out:json][timeout:9999];
/* Query to find bus stops within the bounding box that have at least
- one bench
- one trash can
- two recycling containers
This all needs to be within 50 meters*/
node["highway"="bus_stop"]({{bbox}})->.busstops;
foreach.busstops->.busstop {
node(around.busstop:30)["amenity"="bench"]->.benches;
node(around.busstop:30)["amenity"="waste_basket"]->.trash;
node(around.busstop:30)["amenity"="recycling"]["recycling_type"="container"]->.recycling;
if (benches.count(nodes) == 1 && trash.count(nodes) == 1 && recycling.count(nodes) == 2) {
node.busstop;
out geom;
}
}
7 Water on both sides #
This one I’ve seen it being solved in various ways, once could get reverse search to work by realy trying it on everything :
Another way of doing it was to recognize that it looked like Corsica from the reverse search outputs, and look for an isthmus (term used loosely here) between a lake and the seashore, with a medium-sized city around the lake.
8 Gotta overpass that Carrefour #
This one was by far the funniest to see being solved (or not) by participants.
The challenge drops you in front of a convenience store called “Carrefour” (one of the main french ones) in a commercial area. One of the methods was to just check all the “Carrefour” there are (which counting every “Carrefour”-branded places amounts to 6,468 entries) :
Another strategy (that would go faster) would be to check the (mere 50ish) Coiff&Co hairdressers.
The real expected method was to check using overpass all the Carrefour stores that had a Coiff&Co hairdresser and a pharmacy next to them.
Once again the code :
[out:json][timeout:9999];
/* Query to find Carrefour Market stores within the bounding box that have exactly
- one pharmacy
- one Coiff&Co hairdresser
all within 50 meters*/
node["shop"="supermarket"]["brand"="Carrefour Market"]({{bbox}})->.carrefours;
foreach.carrefours->.carrefour {
node(around.carrefour:50)["amenity"="pharmacy"]->.pharmacies;
node(around.carrefour:50)["shop"="hairdresser"][~"^brand|name$"~"^Coiff&Co$"]->.coiffcos;
if (pharmacies.count(nodes) == 1 && coiffcos.count(nodes) == 1) {
node.carrefour;
out geom;
}
}
A brief word on the platform we developed. #
Together with Baptiste Rébillard (another member of my CTF team) we made the following interface :
Here is a scaled-down version of the interface with only one map (from last year) and a hard-coded answer (of course in the real CTF the coordinates were in the back-end and not available on the front-end). I also reduced the number of passive-aggressive gl4d0s lines. Please note that in the real CTF you had to be within 20m to have the flag. In the scaled-down version if you click 100m away it will still count as good due to me being lazy (I just took a rounding of the lat/long values instead of computing the distance) but at least you can get roasted by Gl4d0s and that’s already something :)