Table of Contents
- Challenge Overview
- Step 1 — Circuit Name
- Step 2 — EXIF Analysis
- Step 3 — Event Date
- Step 4 — Mexican Restaurant
- Step 5 — After Party Bar & Full Address
- Step 6 — DJ Stage Name
- Step 7 — Cave
- Step 8 — Phone Number
- Answers
- Tools Used
- What Didn't Work
- Lessons Learned
Missing Person — TryHackMe CTF Writeup #
Platform: TryHackMe
Category: OSINT
Difficulty: Medium
Date: 2026-03-19
Author: t0nt0n
Reading time: ~5 min
Challenge Overview #
Two images (food.jpg, MotoGP.jpg) and a chain of clues are provided. The goal is to answer 8 questions by tracing a missing person's steps through OSINT — EXIF metadata, certificate transparency logs, Google Maps, and social media.
Step 1 — Circuit Name #
The MotoGP.jpg image shows the PERTAMINA signage on a race circuit. Combined with the Indonesian setting visible in the food photo, this is the:
Pertamina Mandalika International Street Circuit (Lombok, Indonesia)
Step 2 — EXIF Analysis #
1exiftool food.jpg
2exiftool MotoGP.jpg
EXIF output — sensitive timestamps
food.jpg → Date/Time Original: 2025:10:05 19:55:30
MotoGP.jpg → Date/Time Original: 2025:10:05 12:33:12
Both photos taken on 2025-10-05 → race weekend at Mandalika.
Photo time (food.jpg): 19:55:30
Step 3 — Event Date #
The 2025 Indonesian MotoGP Grand Prix at Mandalika ran 03-05/10/2025 (Friday practice → Sunday main race). The photos confirm race day = October 5.
Step 4 — Mexican Restaurant #
food.jpg shows a colorful restaurant with shipping containers and papel picado decorations. Visible text on a table reads "CANTINA MEXICANA".
Restaurant: Cantina Mexicana (Kuta Lombok)
Step 5 — After Party Bar & Full Address #
Searching for MotoGP after parties in Kuta Lombok on October 5, 2025 surfaced Surfers Bar Kuta Lombok (Facebook post: "biggest party after the MotoGP race, Sunday 5 October 2025").
Full address from Google Maps:
Jl. Raya Kuta, Kuta, Kec. Pujut, Kabupaten Lombok Tengah, Nusa Tenggara Bar.
Step 6 — DJ Stage Name #
Searching for local DJs at Surfers Bar Kuta Lombok revealed the bar is owned by brothers Bong and Wona. The Facebook account @bongleleh is associated with the bar and DJ activity.
DJ stage name: Bong Leleh (4+5 letters — matches the answer format **** *****)
Step 7 — Cave #
Bong Leleh's Facebook page (facebook.com/bongleleh) is titled "Gua Sumur Lombok" — the cave he takes tourists to. Gua Sumur is a famous limestone cave near Mandalika known for dramatic light effects.
Cave: Gua Sumur (3+5 letters)
Step 8 — Phone Number #
The phone number for Bong Leleh's tour business was found directly on his personal Facebook page facebook.com/bongleleh — NOT on third-party sites like Wanderlog or the Monkey Cave Google Sites page.
Phone number
085333137345
Answers #
Circuit: Pertamina Mandalika International Street Circuit
Event date: 03-05/10/2025
Mexican restaurant: Cantina Mexicana
Photo time: 19:55:30
Bar address: Jl. Raya Kuta, Kuta, Kec. Pujut, Kabupaten Lombok Tengah, Nusa Tenggara Bar.
DJ stage name: Bong Leleh
Cave: Gua Sumur
Phone number: 085333137345
Tools Used #
exiftool— EXIF metadata extraction from both JPGs- Google Maps — full bar address lookup
- crt.sh — not needed for this challenge
- Facebook / Instagram — Bong Leleh's social media for cave and phone
- WebSearch / WebFetch — MotoGP event dates, restaurant ID, bar confirmation
What Didn't Work #
- DJ Panda / King Panda — performed at Mandalika Beach Club, not Surfers Bar; wrong DJ
- Monkey Cave — Bong Leleh's Facebook links to Gua Sumur, not Monkey Cave
- Phone from Monkey Cave site (
085337227709) — wrong number, different business - Phone from Wanderlog (
082339064733) — aggregated third-party number, incorrect - The correct number was only on Bong Leleh's personal Facebook page directly
Lessons Learned #
- Always run
exiftoolfirst on provided images — timestamps and GPS data are gold - For address format questions, use the exact Google Maps string (includes
Kec.,Kabupaten, etc.) - When hunting contact info for a person, go to their primary social media profile — aggregator sites (Wanderlog, Google Sites) often list outdated or misattributed numbers
- The answer format hint (
**** *****) is crucial — it immediately ruled out "DJ Panda" (2+5) and confirmed "Bong Leleh" (4+5) - Facebook page titles can differ from the username —
@bonglelehis titled "Gua Sumur Lombok", the key link between the DJ and the cave