Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.jaspervanzeir.be/llms.txt

Use this file to discover all available pages before exploring further.

For this challenge, we were provided with a PDF file named postcard.pdf. I opened the PDF and found exactly what the name implied: an image of a postcard, complete with handwritten text and a postage stamp.
Image
My initial thought was that the text on the card was purely a distraction (a cover) used to hide a secret message or location. I read through the message once, but nothing really stood out to me.

​
Enumeration & OSINT

Just to be absolutely sure, I read through the text a second time, and that’s when something caught my eye. I noticed that the word tornado had a slightly different color compared to the rest of the ink. I scanned the rest of the card and noticed that the words fled and veto shared this exact same distinct color. They were the only three words colored this way. That was highly suspicious.
Image
My first instinct was to Google these three words together. Maybe they referred to a specific news article, a book, or a well-known location? Unfortunately, that was a dead end. I then expanded my search to phrases like “tornado fled veto hidden location”, but still found nothing useful. I realized I needed to change my approach and search for the methodology rather than the specific words. I searched for “three words to find location”. Bingo! This query led me straight to What3Words (w3w), a geocoding system that has divided the entire world into a grid of 3x3 meter squares, assigning a unique three-word address to each square.

​
Pinpointing the Location & Converting Coordinates

I went to the What3Words website and entered the combination: ///tornado.fled.veto. The site instantly dropped a pin on an exact 3x3 meter square located on Moeskroenstraat in Menen, Belgium! I now had the physical location on the map, but the challenge specifically required MGRS (Military Grid Reference System) coordinates.
Image
To convert this What3Words location into standard usable coordinates, I clicked the “Navigate” button on the w3w website. This automatically opened Google Maps with directions to that exact spot. Looking at the Google Maps URL, I could easily extract the decimal Latitude and Longitude: 50.790063, 3.146345.
Image
The final step was converting these standard GPS coordinates into the required MGRS format. For this, I navigated to an MGRS Converter tool on latlongdata.com. I inputted the latitude (50.790063) and longitude (3.146345), hit convert, and voilà: the website generated the exact MGRS coordinate for the secret location!
Image
Obtained MGRS: 31U ES 10315 26489

​
Tools Used

  • Google Search: For OSINT to discover the What3Words geocoding concept.
  • What3Words (w3w): To translate the 3-word code (///tornado.fled.veto) into a physical map location.
  • Google Maps: To extract the decimal GPS coordinates (Lat/Long) from the routing URL.
  • LatLongData MGRS Converter: To successfully convert the decimal degrees into the Military Grid Reference System format.

​
Summary

  • Key Steps: I noticed subtle color differences in three specific words on a postcard, identified this as a What3Words address, extracted the corresponding GPS coordinates via Google Maps, and successfully converted them into MGRS coordinates.
  • What I Learned: This was a fantastic introduction to alternative geographic coordinate systems. While I was familiar with standard Latitude/Longitude, the existence of systems like What3Words (which encodes the entire globe into words) was completely new to me and is an amazing trick to keep in my OSINT toolkit.
  • Crucial Mistakes/Takeaways: My initial, somewhat naive searches (Googling the three words together hoping to find an article) led nowhere. The main lesson here is to think more abstractly: instead of trying to figure out what the data means, I needed to figure out what system formats data in this specific way (three random words). Recognizing the format was the key to solving it.