Summary of Sleuthing and answers | Bloodhunt | Page 1

quasi zealot Apr 28, 2023, 4:21 PM

#

Here you have the thread

#

@eternal mural @robust saffron

robust saffron Apr 28, 2023, 4:24 PM

#

FOR THOSE CATCHING UP

Answers
ZIP Password = zelezna
UNCIPHERED URL = https://bloodhunt.com/omnis
QUESTION 1 = vltava river
QUESTION 2 = Goliath
QUESTION 3 = my name is edvin and i have been living in the massive bunker under prague for the last 5 years.
QUESTION 4 = Echo
QUESTION 5 = Abfsrengh 1922
QUESTION 6 = Vbe Ccflt vmk Dramyxs
QUESTION 7 - Hans Christoff von Königsmarck
QUESTION 8 - Jraprfynf Xříž
QUESTION 9 - hořící kostel

----Summary of Sleuthing-----
PART 1 - ZIP FILE
The password to unzip the files in the provided zip was the name of the real life location corresponding to the street Omnis was standing in game - this gave a QR Code and A SHA file
zelezna
PART 2 - QR
The zip file contained a QR Code, this QRCODE linked to "gssor://aknncgtms.bnl/nlmhr" which can be decoded using a shifting +1 cipher to " https://bloodhunt.com/omnis "
PART 3 - QUESTIONS
Q1
*Visiting the URL https://bloodhunt.com/omnis provides the user with a prompt with a question
"Enter your answer with style"
The word style was a reference to the css style sheets of the website, where the hexadecimal numbers "56 4F 56 4C 4F 4C 54 4F 54 41 56 4F 56 41 20 52 4F 52 49 56 4F 56 45 52 4F 52" were found.
This was converted from HEX to ASCII which gave VOVLOLTOTAVOVA RORIVOVERO.
Deleting the O's and the repeated letters give the answer of "vltava river" which is the river that runs through the Prague in game.

Q2
The next question (https://omnis.pages.dev/part2-d40d2703-e230-4786-a366-6f6e2828794b/) was "ISam17.51" followed by an Anhk Symbol. reference to the Bible verse 1 Samuel, Chapter 17 - Verse 51
This passage describes David killing the champion of the Philistines who was known as Goliath.
A bonus hint could be found by entering in "shielded by faith" Which is found in game written next to SAM17.51
The answer was "Goliath" , who coincidentally has a statue of him in real life near where omnis was standing in game.

Bloodhunt - Free-To-Play Battle Royale Game - Play free now!

The Omnis Challenge

Bloodhunt is a free-to-play battle royale game where you use supernatural powers to fight to become the ultimate vampire. Play free now!

#

**Q3 **
“§1 Omnis Chambers”
https://omnis.pages.dev/part3-9c615232-e6d8-46a1-ad42-c03ae9fc9703/
In Omnis' chambers there was an encrypted clue written on the wall
Which needed three keys that had been slowly been scattered around the map the last few patches.
The three keys were found and fed into an enigma cipher machine to decrypt the message.
§1 referred to the first section of said clue.

znhy dntc ykimzf wx ypb
pvfivux ezvhzh dcost
tdhiwm dqy ezk jxwe 5
rzteh.
yk opb rur nzerywn dpzd,
zxx dhlj npksseqdqs ea
fuivdya qjl uugu puv
nhuorybl ljkncrm... zwse
tcc ep sdz wgh gy jdlg eiv
ryechwjr?
- EW

my name is edvin and i
have been living in the
massive bunker under
prague for the last 5
years.
if you are reading this,
you have deciphered my
message and only one
question remains... will
you be the one to find the
entrance?
- EW```
**__Q4__**
*"In sooth, what be I that speak sans mouth,*
*and hear sans ears, in ways uncouth?*
*Of flesh or form, I have no sight,*
*Yet wind's sweet kiss brings me to light.*

*What creature am I, one might ask,*
*Whose form eludes the mortal task?*
*Nay, I be none, save for the breeze,*
*That rouses me from my great peace."*
The answer to the riddle was the word echo.

robust saffron Apr 28, 2023, 5:37 PM

#

Q5 -

Secrecy needed. ROT13 answer wanted.```
```sTiDOpnADnmSegoHuHhlSacAnHLdSSsAhDDsAraSetHhsytHooSunADaLAHSS```

Decrypt the title of the webpage using RailFence Cipher (We bruteforced, but could be done using other means?)
Gives "SLASH STASH SLASH OMNIS DASH HANDS DASH YOU DASH ANOTHER DASH CLUE DOT PNG"
Convert that into a URL and amend to the website
```https://omnis.pages.dev/stash/omnis-hands-you-another-clue.png```
https://omnis.pages.dev/stash/omnis-hands-you-another-clue.png
This picture has several letters on it these letters spell F. W. Au Mu Rn
Which is an Anagram of F.W. Murnau -Friedrich Wilhelm Murnau  (director of Nosferatu 1922 movie)
Nosferatu 1922 -> Encoded into ROT13 as asked for by quesiton gives the answer of
Abfsrengh 1922

#

Q6 - CURRENTLY IN PROGRESS

Bring back an encoded message.```
Website code had 
<!-- 2FOMNIS73OMNIS74OMNIS61OMNIS73OMNIS68OMNIS2FOMNIS75OMNIS6EOMNIS72OMNIS65OMNIS6COMNIS61OMNIS74OMNIS65OMNIS64OMNIS2EOMNIS6DOMNIS70OMNIS33OMNIS -->  (and another similar)
Removing all instances of OMNIS left us with 2F 73 74 61 73 68 2F 75 6E 72 65 6C 61 74 65 64 2E 6D 70 33 (and another similar)
Which translated to two url's of mp3. 
https://omnis.pages.dev/stash/unrelated.mp3
https://omnis.pages.dev/stash/deception.mp3
The mp3's needed to be reversed and were in german. One had a passage from the Art of War being recited over the german Nosferatu clan trailer music, the other had a audio clip from a documentary.

--- Original
```# unrelated.mp4
Nichts war in der DDR so geheim wie die Struktur und Arbeitsweise des Ministeriums für Staatssicherheit.
Fast 100.000 Hauptamtliche und 150.000 inoffizielle Mitarbeiter waren Tag und Nacht im Einsatz.
Die BEdrohung, die vom MFS ausging war unbestimmt und unkalkulierbar. Die Methoden waren leise und weitgehend unsichtbar.```

```# deception.mp4
Jeder Krieg basiert auf Täuschung, der gleichgültige, ruhige, teilnahmslose Krieger wird obsiegen, nicht der rachsüchtige Heißsporn oder der, der das Glück erzwingen will```

--- Translated
```# unrelated.mp4
Nothing was as secret in the GDR as the structure and working methods of the Ministry for State Security, 
almost 100,000 full-time and around 150,000 unofficial employees were working day and night night the threat 
emanating from the MfS was indefinite and unpredictable the methods were quiet and largely invisible```

```# deception.mp4
All warfare is based on deception. Hence, when we are able to attack, we must seem unable; when using our forces, we must appear inactive; when we are near, 
we must make the enemy believe we are far away; when far away, we must make him believe we are near.```

robust saffron Apr 29, 2023, 4:05 AM

#

Code at the top of the java script was found
Noqn pljk, Msruyef. Isl tiirx elef sx.
Was translated using a Vigenere cipher (key:hacker) to
Good luck, Kindred. You might need it.

A cat walked across Leons keyboard and left us 836FYWNFKT

Flipped Audio recordings

turbid belfry Apr 29, 2023, 10:11 AM

#

Answer to #6:
Translate "The Art of War" in to German: Die Kunst des Krieges (deception.mp3)
then using Vigenere cypher stasi (unrelated.mp3) as key

ANSWER: Vbe Ccflt vmk Dramyxs

turbid belfry Apr 29, 2023, 10:33 AM

#

Q7 - https://omnis.pages.dev/part7-07c84e24-8e47-445e-a8f5-aead7bbf3e22/
“Gallow's Hill I. Who commanded the forces?”

A IRL commander Hans Christoff von Königsmarck who fought in the Battle of Prague (1648) with the Swedes - See also: https://whitewolf.fandom.com/wiki/Quest:Gallow's_Hill#Part_1_-_The_Dying_Man

White Wolf Wiki

Quest:Gallow%27s_Hill

Gallow's Hill is a seasonal quest introduced in Bloodhunt's 0.5 patch. At the time of its release, this quest is unique from the other quests introduced in the game as it provides character...

robust saffron Apr 29, 2023, 11:12 AM

#

Q8 - https://omnis.pages.dev/part8-87dee686-1a6f-413a-8d35-ffc3966af79a/
/stash/znrtsgburmvhgivvgrmkiztfv.png
Website title : "Fancy a drink"
Cipher was identified on the text of the png name as an atbash cipher.
The decoded text was replaced inthe url with the result "amightyfinestreetinprague" which in turn lead to https://omnis.pages.dev/stash/amightyfinestreetinprague.png

#

This was discovered to be a screenshot from the tutorial level

Leons Cat strikes again - Ixjipětny hu ináteo u ixygehěny xpyřy.
ROT-6 gives us->
Odpovězte na otázku a odemkněte dveře.
Translate into english
Answer the question and unlock the door.

vivid elm Apr 29, 2023, 12:23 PM

#

On the right of this screenshot in game, a bar named betlémská stands, which is also a drink. Entering this causes new text to appear:

⬆ wxsaht oonwxscs nhlwhloly

turbid belfry Apr 29, 2023, 10:28 PM

#

Q8 - Using the Beufort Cipher on the above code wxsaht oonwxscs nhlwhloly with the key of yesplease give us the following chapel merchant rthirteen
This leads us to the The Bethlehem Chapel which was built by Wenceslas Kříž (known as 'the Merchant'), if we input this in to a ROT13 decoder we receive the answer:
Jraprfynf Xříž

robust saffron Apr 30, 2023, 4:06 PM

#

Q9 - https://omnis.pages.dev/part9-5576535d-d238-4f17-8f8f-84fa6d2637a6/
Nikdy nezapomeň na svou minulost.

#

nk-BFRT-geiKSEXpyvRRIGqfarfkrOAVLdxjgLGYlam is the placeholder text
KFBEPllutt-wffct-qvvjsqfmw is the Submit button text
Using the word 'SUBMIT' as a key in a Vigenere cipher gave the result SLASHstash-omnis-encrypted

Čekání... is instead of waiting

Nikdy nezapomeň na svou minulost. translates to Never forget your past.
Čekání... Translates to Waiting...
Beaufort Cipher translated the Placeholder text to :
https://omnis.pages.dev/stash-omnis-encrypted/leons-cat-created-this.png

robust saffron Apr 30, 2023, 4:55 PM

#

The image of Omnis with the following writing

data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACEAAAAHCAIAAAAJc7MTAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAbUlEQVQokZ2SMQ4EMQgDxxL//zJbIHFcyLpYisjExEYQZaYkAMhMQFKBA1faZZMtMHX+8PWNT7d0n6yQFFfiW+x5FI4rZ4y7eMeUniKxFc24Dva4n9uaK4m3poxiG3v735qnoWmz1Vl/xM8WeAAaCHr5lbGrzgAAAABJRU5ErkJggg==``` This was converted to the following image:

robust saffron Apr 30, 2023, 6:01 PM

#

#

This image was then flipped to make

#

S:t Giles
St Giles is a church in Prague

turbid belfry Apr 30, 2023, 9:43 PM

#

Q9 ANSWER
St. Giles. is the burning church (in-game), if we translate burning church in to Czech we get the answer
hořící kostel

turbid belfry Apr 30, 2023, 10:07 PM

#

Q10

mnlygwa gvby hnjm dpah "tjuov"```

#

#

Note, Final H is underlined
and F and H are struck through

#

100BC was the year Caesar was born, we are looking at the Caesar Cypher.

#

7 spaces are underlined, so we have an offset of 7
And we use an alphabet that does NOT include F and H abcdegijklmnopqrstuvwxyz
Input the code and we get the answer:
decrypt your head with "mango"

robust saffron May 1, 2023, 3:28 AM

#

https://omnis.pages.dev/part10-0d630934-40e1-4e03-a64d-a8fd05a4bd4d/ URL OF 10

Mango is the name of Leon's cat.
Infodump about Mango
#bloodhunt-secrets message

grim sequoia May 1, 2023, 3:02 PM

#

What we have
Final Hurdle (implies last question)
100BC led us to Caesar Cipher that we used 7 characters underlined as shift and alphabet without F and H (crossed out) to decipher "mnlygwa gvby hnjm dpah "tjuov"" to "decrypt your head with "mango""
We assume "mango" will be the key to a cipher to whatever "your head" turns out to be.
We've interpreted "your head" as anything from anatomical head to leader etc.
2 separate messages from Leon saying specifically no one has "conquered stage 10"
Leon asked if we looked deep enough
Mango turned out to be the name of Leon's cat, later to be told "it's but a word" and not a name
"what you need is something you've been given many times" (ciphers, pngs, ???)
"Mango turns 13 today" cipher with a shift of 13? (rot13????)

grim sequoia May 1, 2023, 3:36 PM

#

strange header in the response, but probably nothing
omnis-communication: Key + 19.8.1 === k_vbfrt || glnmtorxpfskzngchzrohagedcwphaidvipkrjm3

robust saffron May 1, 2023, 4:18 PM

#

https://omnis.pages.dev/stash/classified-audio.mp3

turbid belfry May 1, 2023, 5:46 PM

#

Q10 ANSWER: Look in the Dev Tools (F12) network tab, look for the response when submitting an(y) answer:
Key + 19.8.1 === k_vbfrt || glnmtorxpfskzngchzrohagedcwphaidvipkrjm3

Key = mango
19 = S / 8 = H / 1 = A
SHA
k_vbfrt = key variant beaufort

SHA256, from the zip folder in part 1: 6048E8CD1DC170A940BB774FB4AEBB5EB74308F745C3481AABE6073591DA1A19
variant beaufort:
mango6048E8CD1DC170A940BB774FB4AEBB5EB74308F745C3481AABE6073591DA1A19
= mangoecddcabbfbaebbebfcaabedaa (no numbers)

Encrypted input: glnmtorxpfskzngchzrohagedcwphaidvipkrjm3 / key: mangoecddcabbfbaebbebfcaabedaa / Output: slashstashslashclassifieddashaudiodotmp3
https://omnis.pages.dev/stash/classified-audio.mp3


OMNIS ENCOUNTERED A VIDEO OF VERA BEING BURNT TO ASHES,
MOST LIKELY BY AN ENTITY HUNTER,
BEFORE SHE COULD ADVANCE TO THE GRAVEYARD.
AT LEAST THESE CLUES DID NOT END UP IN THE HANDS OF THE ENTITY.
BUT THE CIRCUMSTANCES SURROUNDING VERA'S DESTRUCTION CALLS FOR FURTHER INVESTIGATION.```

turbid belfry May 1, 2023, 7:28 PM

#

(Note, the Morse code did not have the spaces, I added these after)
The Morse code specifically refers to the 'Missing Agent' quest (https://whitewolf.fandom.com/wiki/Quest:Missing_Agent) which rewards the player with the 'Decay' player icon.

Submitting the answer decay gives us this clue: gnp.TKFNWYF638/2hsats/ this is backwards for: stash2/836FYWNFKT.png

ALSO:

Inputting the answer vera gives us the same clue: gnp.TKFNWYF638/2hsats/
+ 836FYWNFKT is the cat code from several days before that was edited to be removed by Leon

https://omnis.pages.dev/stash2/836FYWNFKT.png is a profile picture from the game, specifically "Janus" which is rewarded for completing the 'A Spy in Prague' questline - https://whitewolf.fandom.com/wiki/Quest:A_Spy_in_Prague

This specific image though has the number 13 hidden at the top of it indicating use of the ROT13 cipher

janus in rot 13 = wnahf
Submitting the answer wnahf gives us the clue Tread carefully: vfgxk://taeuk.uxr/lvalsHMuW2W8uJMC8

Using a variant beaufort vigenere cipher with key omnis on vfgxk://taeuk.uxr/lvalsHMuW2W8uJMC8 gives us a link:
https://forms.gle/ddmzfZUgK2J8mRYQ8

!!! This is the final part of the ARG and is to be completed by yourself. !!!

#

Note:
As per Leon all of the webpages are staying permanent following the ARG.
Announcement / Start: https://bloodhunt.com/en-us/news/the-omnis-challenge

Part 1: https://omnis.pages.dev/
Part 2: https://omnis.pages.dev/part2-d40d2703-e230-4786-a366-6f6e2828794b/
Part 3: https://omnis.pages.dev/part3-9c615232-e6d8-46a1-ad42-c03ae9fc9703/
Part 4: https://omnis.pages.dev/part4-61be5a2e-b8d0-47bf-8c92-f6b14f9f2ae7/
Part 5: https://omnis.pages.dev/part5-8eb95950-e1f2-43b1-86f7-5bdbacfbbaaf/
Part 6: https://omnis.pages.dev/part6-cabbe8cf-cb8f-4301-9b97-9f007ac9f326/
Part 7: https://omnis.pages.dev/part7-07c84e24-8e47-445e-a8f5-aead7bbf3e22/
Part 8: https://omnis.pages.dev/part8-87dee686-1a6f-413a-8d35-ffc3966af79a/
Part 9: https://omnis.pages.dev/part9-5576535d-d238-4f17-8f8f-84fa6d2637a6/
Part 10: https://omnis.pages.dev/part10-0d630934-40e1-4e03-a64d-a8fd05a4bd4d/

The end Google form is now LOCKED! 5 winner have been selected.

turbid belfry May 2, 2023, 10:11 AM

#

Answers to the now locked Google form, as provided by Tobias:


Fav food: Rats (accepted variants in substitute: animal blood) (and if with great (other) answers: vitae/blood)

Poster text: Parsifal (variants like Parsital accepted)

Vulnerability: While mitigating the damage from such an attack is quite a hassle, it involves temporarily disabling the application (and network), and shutting down the service, to then do a full investigation into how the perpetrators gained access and then resolving the issue. Then, upon going live making sure to immediately force all the users for that web application to update their passwords. Additionally, enforcing some kind of 2FA-solution is recommended. (There are several more correct answers for this one)

#Summary of Sleuthing and answers