Or: How I learned to stop worrying and love the Overpass
This was a fairly straight forward challenge that gave me plenty of chances to explore some alternative ways of doing things. Instead of this being a walk-through write-up, I’m going to go quite a bit in detail about two of the things I’ve been learning lately in my OSINT journey.
One of them is Overpass Turbo and the other is a fun thing you can do to get better at Geo-Locating. If you’d like to skip over the part where I talk about those things, ctrl+F search for the last mention of ‘Cont’d:’ to skip directly to me Geo-locating all images in this contract. So let’s first hop into the briefing to even understand what is happening here:
Briefing:
Greetings, Special Agent K.
We have received a concerning call from Frank, a retired agent who used to work in our agency. He mentioned that his father went on a trip around the world and was supposed to return yesterday, but he never did. Frank is worried that his father may have been abducted in one of the cities he visited, as he is fairly rich and famous.
We have collected pictures of all the places the father visited through his Facebook account. Once we have located these places, we will send the B.T.R.U to search for him. Your job is to find these locations and report them to the agency as soon as possible.
As always, Special Agent K, the contract is yours if you choose to accept.
Investigation:
Frank’s dad is lost, we can’t have that, so let’s find him! We’ve got 10 pictures and one clue already.
Frank’s dad was on a trip around the world so we’re likely looking in somewhat popular and tourist-y places all over the world.
Let’s get into the pictures:
Location 1:
First off, I see a waterway, which makes me think a city with canals. The architecture doesn’t read “Venetian” to me on first impression, so my first guess is that we’re likely somewhere in the Netherlands.
The flag on the boat in the left corner (red) confirms my suspicion for now. So what’s next? What my eye is first drawn to is the bridge (yellow) and that there’s a lot of bicycle parking (green) nearby.
At this point I’m thinking about using overpass to find at least a manageable amount of places that will allow me to street-view it. I’ll call this the manual way and that will come up in a little bit.
A quick reverse search with Yandex shows me there’s a likelihood that this is Amsterdam. It definitely looks like it could be and Amsterdam is a popular tourism destination so I’m sticking to that until proven wrong.
First, the easy way:
When I zoomed in on the area with stairs (blue), I saw a sign on the railing. I wasn’t able to make out anything except “Golden” on it. Let’s give it a quick try on Yandex by cropping the search area to just that building:
That first result in “similar images” looks promising. Clicking it doesn’t show me right away where to find this building, but it has a more readable version of the sign, which is “Golden Bend”, so let’s give Google a try with that.
Query: “Golden Bend” Amsterdam
This returns the Golden Bend store in Amsterdam. Using street-view here I can confirm that this is indeed the correct store.
The location the picture was likely taken from is within ~10m of: 52.36512923132151, 4.894590019887944
Now, before I go on to the rest of the walk-through:
Starting here I will explain some details regarding Overpass Turbo query-crafting and a quick recommendation. Afterwards, the walk-through will continue. If you’d like to skip all that because you’re already an Overpass intermediate or pro, or you’re just interested in the coordinates for each picture, press Ctrl+F and search for the last mention of ‘Cont’d:’
I said in my last write-up that I’m a bit of an overpass noob. I do, however, see the potential of the tool so I’ve been doing a little bit of learning that I’d like to share, I’m not very experienced yet at all but I’ll try to explain how to craft queries with some options to narrow down your searches.
First: “Why? The target was easily found with Yandex?”
In some cases, creative cropping will not return the same quality of results I got here and Yandex will throw more red herrings at you than an exploding bag of Swedish Fish. In that case, all I would have to base my (semi-educated) guesses on are landmarks. Overpass is fantastic at landmarks, buildings, stairs, really most meta-data that gets collected for maps. So let’s visit imagination land where store signs don’t exist and craft a query! (It’s really not hard)
The first thing I want to do is tell Overpass to search in all of Amsterdam. The way we do this is by telling it, like so:
// fetch area “amsterdam” to search in
{{geocodeArea:amsterdam}}->.searchArea;This will fetch the area we specify and save it into the ‘searchArea’ variable.
There are other options other than ‘geocodeArea’ as well. I recommend exploring the wiki at: https://wiki.openstreetmap.org/wiki/
Next, an easy landmark to collect info from first would be the canals. So let’s do that using this snippet (‘//’ denotes comments):
(
// query for: “waterway='canal'”
way["waterway"="canal"](area.searchArea);
relation["waterway"="canal"](area.searchArea);
)->.water;This will query Overpass for all Canals within our search area and save the result to the variable ‘water’ (being variables, you can name these any way you’d like, I just pick short and descriptive to save time typing).
The result looks like so:
Thanks to us being able to talk to Overpass via script, narrowing this down is very easy.
To come up with my query, I used the wiki to look up the correct feature names to use, you can find an extensive list of map features to query for at this link: https://wiki.openstreetmap.org/wiki/Map_features
There I used Ctrl+F to look for water, then found the waterways tag, clicking on it’s description showed me all the types and that’s how I was able to craft the correct query. It’s really nice to be able to zero in on specific details of landmarks this way. In this case that’s quite a bit of data to sift through.
We can narrow this down further. One of the main identifiers that I also see in the picture is the bicycle parking. Let’s look that up on the Openstreetmap(OSM) wiki by searching for bicycle and see if the option exists. It does, so let’s use it.
(
// query for: “amenity=bicycle_parking around waterways and assign variable 'bikes'"
node(around.water:100)["amenity"="bicycle_parking"](area.searchArea);
way(around.water:100)["amenity"="bicycle_parking"](area.searchArea);
relation(around.water:100)["amenity"="bicycle_parking"] (area.searchArea);
)->.bikes;You’ll see here that this query is a little more elaborate from the first query, with the addition of ‘node’ and ‘(around.water)’. Let me explain:
‘node’ is one of the ways Overpass uses to identify places. I’m including it here because if I’m not sure exactly where I’m looking I’d like to have as much data to crunch as possible before I filter further. I tried using it for the canal query too but it didn’t return any more info, so I left it out of that one.
‘Around’ is a function that allows me to tell Overpass that I’m looking for bicycle parking near the ‘water’ variable we saved in the previous step.
The ‘100’ after the variable name tells Overpass that I’m looking within 100m of the variable. I picked 100m here to be a bit generous as I wanted to try to not filter down too much to avoid accidentally leaving anything out. If I had gotten too much data out of this, I would reduce the number to 75, then 50 and so on.
“Amenity” is the tag name that overpass will look for bicycle parking under.
At the end we save the output from this into the variable ‘bikes’.
Okay, quick recap. So far we’ve created two variables, ‘water’ and ‘bikes’. And now we want to tie the whole thing together with a nice and fancy bow.
So we filter for bridges that are near the bicycle parking spots we’ve filtered. Pretty simple now:
(
// query for: “bridge”
node(around.bikes:50)["bridge:structure"="beam"](area.searchArea);
way(around.bikes:50)["bridge:structure"="beam"](area.searchArea);
relation(around.bikes:50)["bridge:structure"="beam"](area.searchArea);
)->.maybe;Here I’m looking for a beam bridge that fulfills the condition of being within 50m of bicycle parking that is near water and saving it to the variable ‘maybe’.
How do I know that it’s a beam bridge? Same as before, I looked up the structure type “bridge” in the OSM Wiki and it gave me a nice table of comparison with different bridge types(https://wiki.openstreetmap.org/wiki/Key:bridge:structure).
Then finish the query by telling Overpass to print the results:
// print results
(.maybe;);
out geom;This returns the following:
I hope this gives you a bit of an idea as to how Overpass works and a bit of inspiration to go play with it yourself, because it really is an amazing tool to use. If I hadn’t had that store building to rely on, crafting the query I did would’ve likely found me the correct spot sub-10 minutes on street-view. Always remember, the wiki almost always has your back on things. As always, there may be a more efficient way of doing this out there but this worked for me to go from “complete newbie” to “I have a better understanding of this now” in one morning.
Quick word of warning for Overpass, however. It’s not a “be-all-end-all/OSINT-is-easy-now” tool. Some data it won’t show you, forcing some map-scanning. There’s a little bit of a rant on that in an up-coming write-up. It is still a great tool to use, but you shouldn’t rely on a single tool every time anyway, always cross reference.
Here’s the complete query for copy-pasting:
// fetch area “amsterdam” to search in
{{geocodeArea:amsterdam}}->.searchArea;
// gather results
(
// query for: “waterway='canal'”
way["waterway"="canal"](area.searchArea);
relation["waterway"="canal"](area.searchArea);
)->.water;
(
// query for: “amenity=bicycle_parking and assign variable 'bikes'"
node(around.water:100)["amenity"="bicycle_parking"](area.searchArea);
way(around.water:100)["amenity"="bicycle_parking"](area.searchArea);
relation(around.water:100)["amenity"="bicycle_parking"] (area.searchArea);
)->.bikes;
(
// query for: “bridge”
node(around.bikes:50)["bridge:structure"="beam"](area.searchArea);
way(around.bikes:50)["bridge:structure"="beam"](area.searchArea);
relation(around.bikes:50)["bridge:structure"="beam"](area.searchArea);
)->.maybe;
// print results
(.maybe;);
out geom;Regarding my recommendation as to what you can do to sharpen your mental Geo-location blades quite a bit (for free) I’d highly recommend checking out and playing “GeoTastic” (https://geotastic.net/). It’s basically a free/donation based kind of GeoGuessr type game.
On it you can set up a local game to play by yourself without any multiplayer pressure and have it drop you on random street views all over the planet. In combination with https://geohints.com/, you can learn a lot about different signs and characteristics of places all over the world. It’s also a lot of fun to play with your friends over a beer or three.
Alright, enough rambling. Time to go on to the rest of the walk-through
Cont’d:
Now that we’ve got the learning out of the way, let’s get to the proverbial meat and potatoes of this. Time to get some locations. I will say, these were all really simple finds using the technique I described in the “easy” way of Pic 1, so I encourage you do them yourself even if you follow along here just to cultivate the, very useful, habit of pedantically reverse searching images.
On we go:
Location 2:
Googling ‘famous Ferris wheel’, I found this link: https://www.redbookmag.com/life/g25706641/famous-ferris-wheels-around-the-world/
Slide 10 gives a good hint, so I look for ‘“London Eye” London’.
Looking around on street-view a bit shows us the photo was likely taken within ~10m of: 51.50353560620384, -0.12335575952343604
Location 3:
This is an instant hit with Yandex, showing as “Museum of New Zealand Te Papa Tongarewa”.
More accurately the picture was likely taken within ~10m of: -41.28961995963551, 174.78067263134412
Location 4:
People are driving on the left, combining that with the vegetation makes me think “Japan”, having a hunch this may be Tokyo Tower I Yandex it and get confirmation that we’re indeed looking at Tokyo Tower.
To be exact, the picture was likely taken from within ~10m of: 35.65766595984861, 139.74568905999095
Location 5:
The castle here is the main identifying landmark I want to zero in on first here to see if it yields me a quick result.
With Yandex, I crop out just that part of the picture (Like in the easy version of Pic 1) and see what comes out.
I get some matches that point me in the direction of Burg Eltz in Germany so I look that up on maps and explore the photo-spheres.
The picture was likely taken within ~25m of: 50.206516716558, 7.33483334047721
Location 6:
Yandex gives another instant hit here and shows me it’s near the very imposing Hallgrimskirkja in Iceland.
Likely taken within ~10m of: 64.14212938501909, -21.927693253373103
Location 7:
Yandex to the rescue one more time (Yandex reverse image is just that good) and we go to Barcelona.
One of the results Yandex gives is “Torre de Jaume”, it’s a cable car tower, so it’s time to look that up on maps.
Likely taken within ~10m of: 41.37326290864887, 2.1786967389803156
Location 8:
“Coliseum” is the first thing that comes to my mind. We’re looking for popular tourist destinations. Every good world trip has to include Rome.
And it does indeed include Rome.
Picture likely taken from within ~10m of: 41.88861574982585, 12.49047857591085
Location 9:
The street sign looks European and so does what I can see on the license plates. Using Yandex to search just for the right half of the image, because that looks like an interesting structure, puts us in France.
Within ~10m of: 48.85893481015931, 2.2933780813817006
Location 10:
Not even any cropping necessary and Yandex tells me that this was taken in Sri Lanka.
Within ~10m of: 6.91487710261893, 79.86299744468113
With this, we can craft the password for the flag file and retrieve our super spiffy trading card:
Takeaways from this:
Overpass Turbo is extremely powerful, it’s absolutely worth diving into the art of scripting queries and exploring the wiki.
Yandex is also extremely powerful and should be in anyone’s toolkit.
The best way to learn a new thing is just to dive in and mess it up until you get it right.
RTFM, always.
Constructive feedback is always welcome and appreciated ❤
This write-up was brought to you by: The foster kitten cheer-leading squad
