Persona (484 pts)

Author: farisv

A hacker known as "Ed" has crafted an elaborate online persona, leaving traces scattered across their personal webpage and various digital platforms. Your mission is to investigate and find the traces.

https://persona.chall.cyberjawara.pro

We are given a website that looks like this. Our first information is that the person's name is Edina Salmin, that he's a programmer, and that he has this website and a Facebook profile.

Whenever we're given a website, we can take a look at a lot of things:

• the source code (inspect)

• the metadata (IP, CNAME, domain info, etc)

• how the website is made, etc

Inspecting the website give us the first part of the flag.

We can try adding "/admin" (or any common routing) at the URL just to check how the website will response, and we'll get this.

The website was probably made using Github Pages. That means that the website most probably had the original URL of something like username.github.io, where the username is the website owner's github username. We can check if the current domain of persona.chall.cyberjawara.pro is an alias to the website's original URL using a CNAME lookup tool like https://mxtoolbox.com/CNAMELookup.aspx.

Now we know that this person has a GitHub account at https://github.com/edsalmin.

But for now, let's continue searching the person's Facebook first. Whenever we're given a social media profile, we can take a look at:

• the posts

• the photos (they might reveal something sensitive)

• the bio (it might reveal personal informations)

• the comments

• the person's friends and relation to other people

• how their account relates to other account

• etc

In this case, the person posted this photo, which stands out from other photos. It's a screenshot of VSCode.

Looking closely at the bottom (left), it seems that the person was accessing a Pastebin link.

If we try to visit pastebin.com/raw/a9v29gi, we'll meet a 404 error. This is because Pastebin links have 8-characters code, while what we know has 7. We can bruteforce the last character using BurpSuites' Intruder.

Finally, we found the correct link (https://pastebin.com/raw/a9v29gie) and get the second part of the flag.

Now back to the person's GitHub. Whenever we're given a GitHub account, we can check:

• all the repo, along with past commits

• all the person's contributions (which might be in other people's repo)

• the person's GitHub Gist account (which will have the same username as his GitHub but completely different contents)

Looking at one of his repo, we can see that this commit has the third part of the flag.

And when we check the Github Gist account of his (https://gist.github.com/edsalmin), we find the fourth and last part of the flag :)

Flag: CJ{19f43f6db7328114eea9e1b939f40bc453fdb0b69a4e0006575e49e55fc187cc}