2) Where in the World is Caramel Santaigo?



  • Location: KringoleCon/Courtyard
  • Elf: Tangle Coalbox


Elf's Objective Message

Hey there, Gumshoe. Tangle Coalbox here again.

I've got a real doozy of a case for you this year. Turns out some elves have gone on some misdirected journeys around the globe. It seems that someone is messing with their travel plans. We could sure use your open source intelligence (OSINT) skills to find them. Why dontcha' log into this vintage Cranberry Pi terminal and see if you have what it takes to track them around the globe. If you're having any trouble with it, you might ask Piney Sappington right over there for tips.

The terminal challenge for this objective is the terminal "Exif Metadata" offered by Piney Sappington. Solving this terminal challenge provides additional hints for this objective. To view the hints or the walk-through for this terminal challenge, use the menu on the left.

To start this objective click on the "Caramel Santaigo" terminal or click the link.


Open the developer tools for your browser and copy the cookies for this application.


Copy the cookie from above and use CyberChef to decode the cookie. Remove the '.' from beginning of the cookie.


Decoding Base64 Cookies

Visit Cyber Chef:

  • Put the Cookie Base64 string in the Input field

  • Drag From Base64 and Zlib Inflate operations into the Recipe

  • Set the From Base64 setting to alphabet to URL safe

  • Bake and poof!

The decoded cookie will look like this:

  { "day":"Monday",
    "elf":"Eve Snowshoes",
    "elfHints":["They kept checking their Twitter app.","Oh, I noticed they had a Doctor Who themed phone case.","The elf mentioned something about Stack Overflow and Rust.","The elf got really heated about using spaces for indents.","hard"],
    "location":"Santa's Castle",
    "options":[["Copenhagen, Denmark","Antwerp, Belgium","Tokyo, Japan"],["Vienna, Austria","Antwerp, Belgium","Reykjav\u00edk, Iceland"],["London, England","Prague, Czech Republic","Antwerp, Belgium"],["Placeholder","Vienna, Austria","Edinburgh, Scotland"]],
    "route":["Antwerp, Belgium","Vienna, Austria","Prague, Czech Republic","Placeholder"],
    "victoryToken":"{ hash:\"8f76b2bd4d3f7248eb05d24499df4f6bc15158ebea8b68a34fdc3d0d43926124\",
    resourceId: \"107aae53-818c-4344-9a55-160479226b3d\"}"

From above you can see the route is ["Antwerp, Belgium","Vienna, Austria","Prague, Czech Republic","Placeholder"].

Click Depart by sleigh and Select Antwerp, Belgium.

Click Depart by sleigh again and Select Vienna, Austria.

Click Depart by sleigh one more time and Select Prague, Czech Republic.

Now click on "Visit InterRink" and type the Elf Attributes based on the decoded cookie. For our example, it will look like the following:


Click on Filter Elf and you will see Eve Snowshoes is the only match (which matches the cookie).

Click on Investigate and Click Investigate 1.

You get the following screen:


Select the Elf name from the cookie or filter, in our case it was 'Eve Snowshoes', and press Guess Elf.

You will be greeted with the victory message:



Eve Snowshoes in Prague, Czech Republic.