OSINT Writeup: TryHackme KaffeeSec — SoMeSINT

This is my personal blog documenting the steps involved in solving the above room in TryHackMe

Link: https://tryhackme.com/room/somesint

Level: Intermediate

Task 2- Story

The flags are pretty simple to get us started.

Task 3- Lets get started

  • What is Thomas’ favorite holiday?

Its mentioned in the bio as X-mas or Christmas

Answer: Christmas

  • What is Thomas’ birth date?

His birthday is evident from the below reddit post.

Answer: 12–20–1990

  • What is Thomas’ fiancee’s Twitter handle?

Looking at his followers we can find the twitter handle of his finacee.

Answer: @FHodgelink

  • What is Thomas’ background picture of?

Answer: Buddha

Task 4- Spiderfoot

Skipping this section for now as I need to reinstall Linux virtual machine in my OSINT laptop. It has been a while since I used the Tracelabs VM on it.

Task 5: Connections, connections

  • Where did Thomas and his fiancee vacation to?

Fiancé’s Twitter handle is @Fhodgelink (https://twitter.com/FHodgelink)
Its pretty straightforward as per the below picture.

The flag format is City, Country (7 letters, 7 letters)

So,it will be in the format — — — -, Germany.

Doing a reverse search of this image, indicates its Koblenz in Germany.

Hence, flag is Koblenz, Germany.

  • When is Francesca’s Mother’s birthday? (without the year)

Answer format is : Month XXth

We can see the below tweet

Answer : December 25th

  • What is the name of their cat?

We can see the below tweet


Answer: Gotank

  • What show does Francesca like to watch?

One of the tweets is the below one which shares the name of the program

Answer: 90 day fiancee

Task 6 Turn back the clock!!

  • What is the name of Thomas’ coworker?

I got stuck at this stage. Finally did a waybackmachine to check the snapshot for 21st Dec 2020

Click on the above snapshot

Answer is : minik hans

  • Where does his coworker live?
  • Answer format is : city, country
  • Thomas lives in Nuuk, as per his profile

Looking into Hans reddit profile, we can find the following posts

Answer: Nuuk, Greenland

  • What is the paste ID for the link we found? (flag format)

Hans profile is https://web.archive.org/web/20210104143852/https://old.reddit.com/user/minikhans

Did a wayback machine for 23rd March snapshot.

Answer: ks{ww4ju}

  • Password for the next link? (flag format)

Answer: ks{1qaz2wsx}

  • What is the name of Thomas’ mistress?

Paste the password obtained in above step to the url and the name will be shown.

Answer: Emilia Moller

  • What is Thomas’ Email address?

His email is in the body of the below document

Answer: straussmanthom@mail.com



Love everything OSINT

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store