Ghost Flight — PwnSec CTF 2026

I really enjoy OSINT challenges, especially when they involve real-world information that has to be connected across different sources. This was actually the second time I had this much fun working on an OSINT challenge related to airplanes and flights, so I was particularly interested in following the aircraft's history and seeing how far the clues would take me.

The challenge consisted of 6 questions, but the questions were clearly connected. The main idea I used was to treat the aircraft registration as the pivot.

The interesting part was that I was actually dealing with two different aviation events:

• The user's September 2016 flight from Shenzhen Bao'an (SZX) to Hangzhou Xiaoshan (HGH).
• A separate 2016 cockpit oxygen/fire incident involving another Shenzhen Airlines.

So I decided to investigate both events separately first, then use the aircraft registrations to connect the different parts of the challenge.

1. Finding the fire incident

I knew both airports were in China, and the flight was operated by an airline based in Shenzhen. I searched around the route, date, and Shenzhen Airlines aircraft history rather than searching only for the exact challenge text. The second event was easier to recognize because the description was very specific.

The challenge mentioned that the first officer was smoking in the cockpit, dropped the lit cigarette into the oxygen mask container, and then accidentally selected the oxygen system's Emergency mode. The resulting high oxygen flow caused the cigarette to ignite and start a fire, which was eventually extinguished using a bottle of water. Those details were distinctive enough to search for the incident directly.

I first searched for combinations of:

2016 incident Shenzhen Airlines 19 november Shenzhen Airlines +cockpit fire + oxygen mask + cigarette

I found references to the incident in several sources, and eventually reached a BEA study about oxygen-related fires, which referenced the same incident.That gave me much more confidence that I had found the correct event rather than just a similar aviation fire.

From there, I looked for the aircraft registration in aviation incident databases and Chinese reports. The incident happened on 19 November 2016 at Shenzhen Bao'an Airport and involved a Shenzhen Airlines Boeing 737–86J.

https://www.planespotters.net/airframe/boeing-737-800-b-5363-shenzhen-airlines/ep0lk3

The registration was:B-5363

I then cross-checked B-5363 against an aircraft-history database to make sure that the registration belonged to a Shenzhen Airlines Boeing 737–800.

That gave me the answer for the second aircraft.

2. Going back to the September 2016 flight

The first event was more difficult because the challenge only gave me:

Shenzhen Bao'an → Hangzhou Xiaoshanband the month:September 2016

I initially tried searching the route and different Shenzhen Airlines aircraft records. The important realization was that I shouldn't keep searching only for the flight itself.

The challenge tells us to trace what became of the aircraft, which means the aircraft's registration is the key identifier.

After correlating the September 2016 flight information with Shenzhen Airlines' aircraft records, I identified the aircraft as:B-5360 , the rest became much easier.

3. Following B-5360

I searched directly for: B-5360 Boeing 737-800 Shenzhen Airlines

One of the most useful results was the PlaneSpotters aircraft-history page. It gave me the aircraft's registration, model, operator, serial number, and later lifecycle information.

https://www.planespotters.net/airframe/boeing-737-800-b-5360-shenzhen-airlines/r1yyor

The timeline matched the challenge very well:

• Aircraft: Boeing 737–86J
• Airline: Shenzhen Airlines
• Withdrawn from use: 12 April 2019
• Stored at: Castellón–Costa Azahar Airport (CDT)
• Storage date: 4 June 2019

This was a strong confirmation because the dates and location matched the clues given by the challenge instead of being isolated search results.

4. Finding the final flight

The remaining difficult part was the flight immediately before storage.

The clue specifically says: final flight on 3 June 2019

So I searched B-5360's movements around 3–4 June 2019 rather than searching for a generic flight history. I found records showing the aircraft's final ferry movement through Europe:

Shenzhen → Ürümqi → Helsinki → Shannon → Castellón

https://flyinginireland.com/2019/06/daily-aviation-brief-06-06-2019/

There was also a photo record showing B-5360 at Helsinki-Vantaa (HEL) on 3 June 2019.

https://www.flyfinland.fi/view/26012

That was an important piece of evidence because it gave me a physical location for the aircraft on the exact date mentioned in the challenge.

I then narrowed the movement down to the individual flight leg on 3 June rather than using the whole ferry route.

The final flight was:HEL-SNN

After that, the aircraft continued toward Castellón, where it was stored on 4 June.

5. The final chain

At that point, the investigation had become a simple chain of pivots:

September 2016 flight

Shenzhen Airlines → B-5360 → aircraft history → WFU: 12/04/2019 → later movements → Storage: Castellón-Costa Azahar Airport → movement on 3 June → HEL-SNN

And separately:

2016 cockpit oxygen/fire incident

Shenzhen Airlines → Boeing 737–86J → B-5363

This was probably my favorite part of the challenge because the answers weren't really independent. Each new piece of information helped confirm the previous one, which made the investigation feel more like following a real OSINT trail rather than simply looking up five answers.

and this is how I solved the challange now my final words the method itself taking tiny, unrelated hints and progressively tying them together into a larger picture was what I found most enjoyable about this task.

Cross-referencing various sources, examining timeframes, confirming aircraft movements, and comparing information from several records were all necessary for the study. Every new piece of information aided in refining the search and confirming earlier conclusions.

This, in my opinion, is what makes OSINT intriguing: it's less about discovering a single piece of information and more about making connections, confirming, and drawing conclusions from disparate data until the narrative becomes evident.

واخيرا اللهم علمني ما ينفعني و انفعني بما علمتني

Wishing This Is Helpful