Introduction
FrangiPh0wn was a little teaser CTF run in the lead-up to Ph0wn CTF, an IoT and hardware security CTF held every year in Sophia Antipolis. Four challenges were on offer to get everyone warmed up before the big day.
I played alongside my buddy Miaou, and thanks to the English version of this writeup I scored a Ph0wn t-shirt. Swag is the only thing that truly matters 🎉
📺 Replay available: We did a little recap of this CTF with Laluka live on his channel. We solve all 4 challenges together with Cryptax (one of the creators of Ph0wn) and Miaou. It’s episode 211: FrangiPh0wn CTF - What, How, Who, WriteUps!
The challenge
The description tells us we need to track down where Pico the Croco went surfing, which exact spot it was, and what cocktail he ordered. The post also mentions Instagram… noted.
Analyzing the image
We’re handed this lovely vacation photo of Pico living his best life:
Our reptilian friend is lounging with a red surfboard that reads “Crocodiles Rule Sharks”. Classic.
Reverse image search on Google? Nothing. Alternative engines? Still nothing. To be fair, the ocean is the ocean, it looks pretty much the same everywhere…
Image metadata
We check the metadata, just in case Pico left some traces behind:
Creator: Pico le Croco
Description: Instagram
Authors Position: Vacances de Noël
Date: 2025:12:07 13:54:16+01:00The metadata points us squarely toward Instagram. Off to the socials.
Pico’s Instagram profile
A quick search and we land on our favorite influencer’s profile:
Two interesting posts: a less cropped version of the challenge photo showing more detail, and a shot at a restaurant with a lobster and a cocktail.
Some new clues
The wide-angle shot reveals a few details:
On one sign we can just about read: “Welcome at P… G…”
So we’re after a beach whose name starts with those initials. There’s also a sign pointing to lobster 3 km away.
The Instagram caption hands us the missing piece:
“The Caribbean waves were too small for my taste, so I rented a 4WD and headed to the Pacific. To my surprise, I met lots of friends there!”
What we take away from this:
- The Caribbean waves were too small for him
- He took a 4WD out to the Pacific coast
- We can rule out every beach on the Caribbean side
Identifying the beach
Let’s run a targeted search. If “P” = “Playa” (super common in Latin America):
beaches starting with Playa ending with G Pacific
We get a list of beaches. Cross-referencing it with our criteria, Playa Grande fits perfectly.
Finding the restaurant
Back to Instagram to dig into the dinner. The post shows the cocktail’s ingredients:
- Gin
- Orange Bitter
- Green Chartreuse
- Red Vermouth
Plus lobster. Pico has expensive taste.
We open Google Maps around Playa Grande:
First idea: search for restaurants serving lobster within a 3 km radius. Way too many results, wrong approach.
The cocktail is the key
Change of strategy! Let’s search the cocktail’s ingredients directly:
Gin, Orange Bitter, Green Chartreuse, Red Vermouth cocktail
It’s a Bijou! A classic cocktail that’s pretty rare on bar menus.
The restaurant, found
Searching “Bijou” on Maps around our beach, there’s only one relevant result:
SideBar at Playa Langosta (formerly Bistro Langosta)
Lobster isn’t on the standard menu, but it’s a high-end seafood restaurant. Pico’s caption did say he’d “convinced them to serve him some”. And more importantly, it’s the only place around that offers a Bijou.
We check the cocktail’s price on their menu via Google Maps:
10,500 CRC (Costa Rican colones)
Flag
ph0wn{Playa_Grande_10500.00_CRC}