Apr 21, 2021
OSINT Writeup: TryHackme KaffeeSec — SoMeSINT
This is my personal blog documenting the steps involved in solving the above room in TryHackMe
Link: https://tryhackme.com/room/somesint
Level: Intermediate
Task 2- Story
The flags are pretty simple to get us started.
Task 3- Lets get started
- What is Thomas’ favorite holiday?
Its mentioned in the bio as X-mas or Christmas
Answer: Christmas
- What is Thomas’ birth date?
His birthday is evident from the below reddit post.
Answer: 12–20–1990
- What is Thomas’ fiancee’s Twitter handle?
Looking at his followers we can find the twitter handle of his finacee.
Answer: @FHodgelink
- What is Thomas’ background picture of?
Answer: Buddha
Task 4- Spiderfoot
Skipping this section for now as I need to reinstall Linux virtual machine in my OSINT laptop. It has been a while since I used the Tracelabs VM on it.
Task 5: Connections, connections
- Where did Thomas and his fiancee vacation to?
Fiancé’s Twitter handle is @Fhodgelink (https://twitter.com/FHodgelink)
Its pretty straightforward as per the below picture.
The flag format is City, Country (7 letters, 7 letters)
So,it will be in the format — — — -, Germany.
Doing a reverse search of this image, indicates its Koblenz in Germany.
Hence, flag is Koblenz, Germany.
- When is Francesca’s Mother’s birthday? (without the year)
Answer format is : Month XXth
We can see the below tweet
Answer : December 25th
- What is the name of their cat?
We can see the below tweet
https://twitter.com/FHodgelink/status/1343023195855736837
Answer: Gotank
- What show does Francesca like to watch?
One of the tweets is the below one which shares the name of the program
Answer: 90 day fiancee
Task 6 Turn back the clock!!
- What is the name of Thomas’ coworker?
I got stuck at this stage. Finally did a waybackmachine to check the snapshot for 21st Dec 2020
Answer is : minik hans
- Where does his coworker live?
- Answer format is : city, country
- Thomas lives in Nuuk, as per his profile
Looking into Hans reddit profile, we can find the following posts
Answer: Nuuk, Greenland
- What is the paste ID for the link we found? (flag format)
Hans profile is https://web.archive.org/web/20210104143852/https://old.reddit.com/user/minikhans
Answer: ks{ww4ju}
- Password for the next link? (flag format)
Answer: ks{1qaz2wsx}
- What is the name of Thomas’ mistress?
Paste the password obtained in above step to the url and the name will be shown.
Answer: Emilia Moller
- What is Thomas’ Email address?
His email is in the body of the below document
Answer: straussmanthom@mail.com
