HI Cyber Con CTF 2026. OSINT.
Shadow Identity
A photo with no metadata and a name spelled three ways. The lab had the full name in 7 minutes.
Published 2 November 2026. Challenge by Hidden Investigations.
The brief
During an intelligence operation, our team recovered a single photograph from a suspect's device. Identify the person in the photograph. Submit the person's full name as the flag. All characters of the flag are lowercase.
- miss_grand.jpeg, 62 KB
In short
A single JPEG with no metadata showed a pageant poster under the banner MISS GRAND TANZANIA 2026. The titleholder is Jihan Dimack, whose name circulates in three spellings. The three part format example and her own spelling of the surname settled the flag.
One photo and no metadata
The only file is miss_grand.jpeg, 481 by 636 pixels. It has a bare JFIF header with no EXIF, IPTC or XMP and no readable text, so the answer had to sit in the pixels and the file name.
A poster that names its stage
The photo is a pageant poster. A woman in a crown and a green beaded gown stands before the flag of Tanzania and Mount Kilimanjaro, under a gold banner that reads MISS GRAND TANZANIA 2026.
One crown, one name
That title has one holder. Jihan Dimack was crowned Miss Grand Tanzania on 8 August 2026 and won Miss Grand International in Bangkok on 10 October, three weeks before the CTF.
Three spellings in circulation
Her name appears three ways. The Tanzanian press and her own handle write Jihan Dimack. The pageant's own caption writes Jihan Mohin Dimachk. Google and the Indonesian Wikipedia write Jihan Mohin Dimack.
The full name, spelled her way
The brief asks for the full name, and its example rahim_ahmed_meow has three parts, so the middle name belongs in it. Her own handle spells the surname Dimack. Of the four possible forms, one fits both.
The insight
A dated banner on a poster gives its subject away. What was left was spelling, and the brief's own three part example settled it.
The flag
hiCTF{jihan_mohin_dimack}