Learning Resources for Cryptic Hunts 

What is a Cryptic Hunt?

Cryptic Hunts are the online equivalent of treasure hunts and require you to hunt the internet for clues to solve given questions, which are supposed to be solved using a plethora of online tools – cipher decoders/encoders and other common methods of data relaying like barcodes, QR codes, etc.

Googling is allowed and heavily encouraged, but it won’t directly get you the answer in most cases. You have to think logically, make connections between different parts of levels. Make sure you check the source of the webpage for any hints hidden there. Cryptic hunts are all about connecting the dots and finding the solutions.

You can think of it like you are given a puzzle, and every piece of that puzzle (an image, a string of text, a video, a strange number) is a hint pointing toward one final answer. Your job is to figure out how all those pieces connect.

1. Levels

• Every clue on a level page points toward a single correct answer. That answer is almost always a word or short phrase related to the world of technology, pop culture or the internet.
• A level can have one clue or several clues. When you have multiple clues, your goal is to connect them and think logically
• In most hunts, there is no fixed difficulty order. Level 0 is typically the easiest and is a good warm-up. However, the level number does not always reflect difficulty. Level 2 might be easier than Level 1 so you should approach each level fresh.
• Entering slashes or trying an SQL injection usually leads to disqualification.

• Extra clues        

Clues can be hidden in places that are not immediately obvious, you can look at the following places to find clues :

The Visible Page-

• Read the level text very carefully. Cryptic hunts use a lot of wordplay, so every single word might matter.
• Check the title of the browser tab/page, it sometimes contains a hint.
• Look at any images, audio files or videos present on the page.
• If the page appears blank, press Ctrl+A to select all text. Hunts often hide clues by making text the same color as the background. Selecting all text reveals camouflaged text.

The Page Source Code -

The source code is the raw HTML behind any webpage. We can also hide clues here :

• View Page Source: Press Ctrl+U (right click, then View Page Source)
• Inspect Element: Press Ctrl+Shift+I (right click, then Inspect).
• Look at the comments (things written under <!--...>).
• There could be other links inside the code. (This especially helps in cases in which there aren’t any on-screen clues.)
• Editing the source code and the URL - In many cases, in relatively more difficult levels, sometimes the submit button is hidden. You may even get a 404 error when you enter the level’s URL. In that case, you may have to enter another URL / play with the source code a bit to crack this.

2. Leads

Lead confirmations are one of the most useful features of a cryptic hunt and many beginners forget to use them.

• Keep getting your leads confirmed from the organizers.  Lead confirmations are short yes or no confirmations that can be asked from event moderators, to confirm whether you’re on the right path while solving the question.
• You can regularly ask the moderators for confirmations that you’re progressing correctly and applying the right logic while solving the level.

• How to ask leads?

You do not need to solve the whole level before confirming, confirm individual steps as you go. Most importantly, don’t be afraid to ask, that is what they are there for.

Eg. If you think the clue is pointing towards Morse code, you can message the moderators and ask, "Is the clue related to Morse code?"        

3. Backlinks

In simplest terms, a backlink is when you find the end part of a URL. In cryptic hunts, instead of getting full links, you’re generally given strings and your job is to identify which site that backlink belongs to. At times, backlinks can also be customized names and not just random strings. Many websites have different formats for backlinks

Eg. You are given the clue - “exunwenoti”

This might be a backlink to -

1. hunt-website.com/exunwenoti
2. bit.ly/exunwenoti
3. tinyurl.com/exunwenoti

You try these URLs until you find one that leads somewhere meaningful

• bit.ly and tinyurl.com or even the hunt website are amongst the most used custom backlinks
• For images, the most famous backlink sites are imgbox.com, imgflip.com, imgur.com, anonfile.top (TIP - These sites can only have random strings in backlinks, and not custom backlinks)
• pastebin.com / controlc.com is also a very famous backlink site, it is used for storing clues. Sometimes, the pastebin can be password encrypted, in that case, we need to find a clue that fits the password.
• bit.ly is a famous URL shortener used along with tinyurl.com (they both can have a customised name as a backlink)
• Often the backlink can be of popular sites like google drive, instagram, word, youtube, dropbox etc.
• The hunt’s site is also used as a backlink in hunts.
• If you are not able to figure out which site the backlink belongs to, you can use a backlink identifier such as a4x.me / backlinks.rex.wf 
• If the backlink you are trying doesn't work, consider whether it might be encoded. Sometimes the backlink itself is encrypted with a cipher. In that case, you must first decode the backlink string (using a cipher) and then use the decoded string as the backlink.
• Random strings (like jG73BsfA) are case-sensitive (jG73BsfA ≠ jg73bsfa).
• Custom/named backlinks (like exunclan) are mostly always alphanumeric, lowercase with no spaces.

4. Ciphers

Ciphers are methods of writing information in a secret pattern or set for encryption and decryption. To crack a cipher we need to identify it and decode it. They are always used in hunts. Most ciphers used in hunts are well known and can be decoded automatically using online tools.

• Decoding Ciphers

If you see a string of text that looks random or unusual, it is likely a cipher. Copy the text and paste it into a cipher identifier tool (given below). The tool will detect and suggest which cipher was used. Use the decoder for that specific cipher to get the english plain text answer.

• Cipher identifiers help to identify the cipher with which the ciphered text is encrypted. The most popular cipher identifiers are dcode.fr cipher identifiers, Boxentriq cipher identifiers.
• Besides dcode.fr and boxentriq.com there are other common sites for ciphers such as cryptii.com, Rumkin.com and Crypto Corner.
• Sometimes the clue is not text at all, it is a set of symbols, shapes or unusual characters. These are called symbol ciphers. A common identifier for this is dcode.fr symbol cipher.

• Morse Code :

Morse code uses dots (.) and dashes (-) to represent letters. It is very commonly used in audio clues (as beeps) or in text form.

Example-  .... . .-.. .-.. --- decodes to HELLO

• Binary Code :

Binary uses only 0s and 1s to represent data. Each group of 8 digits (a byte) typically represents one character.

Example - 01001000 01100101 01101100 01101100 01101111 decodes to Hello

(Tip - Binary in hunts sometimes needs to be converted to Morse code first, by replacing 1 with dash and 0 with dot, rather than directly to text. If binary to text gives no result, try binary to morse instead)

5. Images

• The name of the image file can be very helpful.
• Strings can be hidden in the metadata of the images. Metadata of an image is simply hidden data of an image. Think of it like the label on a physical photograph, except it is written directly into the computer file itself. It is the hidden text information permanently attached to a digital photo that gives you information about an image not so easily accessible.
• You can use tools like metadata2go.com (for viewing metadata) / exif.tools, specifically for EXIF data (EXIF data is a specific category of image metadata. At the beginner level, you can treat them as the same thing for now) Both can contain hidden clues.
• Steganography is frequently used. Steganography is a technique of hiding information within another image, invisible to the naked eye to avoid detection. Tools like stylesuxx.github.io/steganography / aperisolve.com 
• Changing contrast, color schemes, brightness etc.can also help. Online tools can be used along with other tools such as Photoshop / Photopea
• Every image file type starts with a specific sequence of bytes called a header. Organizers sometimes deliberately corrupt an image's header or rename a file to the wrong extension. Hence, the image will not be openable. To correct it, open it in a hex editor like hexed.it and fix the header manually to match the correct file type or use corrupt image viewers available online.

6. Audio Files

Audio clues are common in cryptic hunts and can be analyzed in several ways. Audio files can hide information that is invisible to the ear.

• The audio content itself is useful and the name of the audio file can be helpful too.
• Text/images in the spectrogram of the audio can give clues. A spectrogram is a visual representation of the loudness of the frequencies in the audio. Spectogram can be viewed in tools like Audacity or any web based tool available on the internet.
• Beeps or clicks  are common in audio files and usually represent morse or binary code. You can convert these on Audio Morse Code to Plaintext tools available online.
• Changing the tempo and/or the speed of the audio may also be helpful to get clues.
• Changing the format may also prove to be helpful as some formats may be easier to modify and play around with.
• Song identifier tools like Shazam are also helpful.
• Some Common audio tools are Audacity, Sonic Visualizer, Deepsound, Shazam and other online sites.

7. Videos/GIFs

• The content of the file itself should be useful.
• There could be a visual representation of morse/binary code, example - blinking lights.
• The audio may need to be extracted/be the only relevant part.
• Sometimes, only some of the frames are relevant; you may need to pause/slow down the video or split its frames into images and view them to uncover clues. Use ezgif.com to split a GIF into individual frames and view each one.
• If the clue is a YouTube video, do not just watch the video. Also check video description, comments, title, channel name or about page.

Sample Level

Level Text: It's a story of an Italian plumber which started with an Arcade Game in 1981.

Source Code: https://imgur.com/a/Fn4OaKo 

Solution: rarewareinnintendo

Explanation:

• From the level text we get an Italian Plumber + An Arcade Game. Combining this we get Mario. Now, from the year 1981+ Mario we get Donkey Kong.

• From the source code, we get an imgur link which leads to an image of Shrek.
• Shrek + Donkey Kong gives “Donkey Kong (Shrek).
• This leads to a spoof of Shrek by rarewareinnintendo.

Keep a check on the leaderboard! The team/person who has solved the most levels by the end of the hunt is the winner.

Happy Hunting!