Post cover image
The-Unbroken-Shelf-Final

August 6, 2026

Kali CTF Writeup: Uncovering “the unbroken shelf” (OSINT)

The Challenge

By LaraCroft

4 min read

The Challenge

There was little to be done — the explosion had turned the drug store inside out and there was nothing left to burn. The only piece of its furnishings which remained was a shelf in the mixing room, on which stood about a score of bottles, not one of them even upset. Most of the column was destroyed, the storefront disappeared. The date was torn away. One shelf remained untouched.

Goal:_ Find the original issue and reconstruct where and when the blast occurred._

Use uppercase letters, replace spaces with underscores, and write the time in 24-hour format.

Flag format: KaliTeam{NEWSPAPER_YYYY_MM_DD_STREET_NUMBER_STREET_TIME}

Step 1: Pulling Every Usable Fragment from the Scan

Torn newspaper scans OCR (Optical Character Recognition) badly by design — that's the whole point of the challenge — so before searching anything, I went through the garbled text line by line and separated signal from noise. What survived:

  • Headline fragment: "Mysterious Explosion Blow[s] Firemen Out of Drug [St]ore"
  • A name: Battalion [Chief] …rence McGuire — clearly a partial "Lawrence McGuire"
  • A clerk's name: Samuel [Slater]
  • A street: Eighth Avenue
  • The specific mechanic of the blast: it blew the contents of the store into Eighth Avenue, and deposited debris across the car tracks
  • The one surviving detail the puzzle explicitly hinted at: a single untouched shelf of bottles in the compounding/mixing room

That's a lot to work with even without a date — a proper name, a battalion chief's name, a street, and a very specific, almost novelistic detail about the shelf that survived. Distinctive wording like that is exactly what you want when searching digitized newspaper archives, since OCR search engines match on exact phrasing.

Step 2: Google Dorking First (and Hitting a Wall)

My first move was the obvious one — try to Google-dork my way to the article using exact-phrase search operators, e.g.:

"blew the contents of the store into the Eighth Avenue"
"battalion" "McGuire" "eighth avenue" "explosion"

This didn't turn up the source. Regular search engines don't index most historical newspaper archive text well, since it's usually locked inside scanned-PDF page viewers rather than crawlable web pages. So the dorking approach hit a dead end fast, and I pivoted to searching the archives directly instead of hoping Google had already indexed them for me.

Step 3: Searching Digitized Newspaper Archives Directly

Instead of a general search engine, I moved to purpose-built historical newspaper databases — Chronicling America (the Library of Congress's digitized newspaper archive), fultonhistory.com, and NYS Historic Newspapers. These sites run full-text OCR search across millions of scanned pages, which is exactly the kind of corpus this challenge needed.

The trick here was that no single phrase worked on the first try — the OCR on the original digitized copy doesn't necessarily match the OCR on the torn CTF image, since scan quality, cropping, and tear damage all produce different misreads. So I iterated through several exact-phrase combinations, swapping in whichever fragments felt most "OCR-stable" (proper nouns and uncommon phrasing hold up best):

"Battalion" "McGuire" "Eighth Avenue" "Mysterious Explosion"
"blew the contents of the store into the Eighth Avenue"
"The only piece of its" "which remained was a shelf"

That third query — built around the oddly specific detail about the shelf — is what finally broke it open on Chronicling America.

Step 4: Landing on the Original Page

I went straight to Chronicling America's search interface and started typing in combinations of the fragments I'd pulled from the torn clipping — "mysterious explosion blow", "firemen", "battalion", "mcguire", "eighth avenue", "drug store" — refining the phrasing each time a search came back empty or noisy.

One of those attempts landed directly on the front page of the New-York Tribune, dated August 21, 1920. The site's viewer highlights every matched term in red directly on the scanned page, so I could see at a glance that "Mysterious Explosion Blows Firemen Out of Drug Store," "Battalion," "McGuire," "Eighth Avenue," and "drug store" were all lit up in the same column — confirming this was the right page before I'd even read a word of it.

None

Once I was on the matching result, the page URL captured the exact search that got me there:

https://www.loc.gov/resource/sn83030214/1920-08-21/ed-1/?sp=1&q=%22mysterious+explosion+blow%22+%22firemen%22+%22battalion%22+%22mcguire%22+%22eighth+avenue%22+%22drug+store%22&r=0.416%2C1.085%2C0.156%2C0.079%2C0&st=pdf

With the full front page in hand, the OCR text on the archive's own copy was far more complete than the torn CTF fragment, and it filled in everything the challenge had stripped out.

Step 5: Reading the Full Article

The recovered article confirmed and expanded every detail:

  • The explosion happened at Slater & Halpern's drug store, 157 Eighth Avenue
  • It occurred "about 8:40 p. m."
  • The proprietor, Samuel Slater, and his clerk, Benjamin Prilek, first noticed smoke near the prescription department
  • Battalion Chief Lawrence McGuire, along with two lieutenants and about a dozen firemen, had just entered the store when the second, larger explosion hit
  • The one surviving detail matched exactly: a shelf in the "mixing room" holding "about a score of bottles, not one of them broken or even upset"

That gave me every remaining piece — publication, date, street address, and time — needed to build the flag.

Assembling the Flag

Variable Value Newspaper New-York Tribune Date August 21, 1920 Street number & name 157 Eighth Avenue Time (converted to 24h) 8:40 p.m. → 2040

KaliTeam{NEW_YORK_TRIBUNE_1920_08_21_157_EIGHTH_AVENUE_2040}

Takeaways

  • Google dorking isn't always the right tool. Search engines don't reliably index text buried inside scanned archive PDFs — dedicated archive search (Chronicling America, fultonhistory.com, etc.) will often succeed where a generic dork fails.
  • OCR text from two different scans of the "same" content won't match exactly. Torn, cropped, or lower-quality scans produce different misreadings than the archive's master copy, so it pays to try several phrase variants rather than trusting one exact quote.
  • The most oddly specific detail in the text is usually the best search anchor. The generic parts of the headline were too common to search effectively; the unusually precise detail about the undisturbed shelf of bottles was distinctive enough to be the phrase that actually worked.
  • Archive deep-links often carry their own metadata. The Chronicling America URL alone — publication ID, date, edition, page — was enough to fully verify the source without needing anything else.