{"id":31827811,"url":"https://github.com/achnouri/sakura-ctf-write-up","last_synced_at":"2026-02-19T14:06:07.687Z","repository":{"id":317040763,"uuid":"1064572837","full_name":"achnouri/Sakura-CTF-write-up","owner":"achnouri","description":null,"archived":false,"fork":false,"pushed_at":"2025-09-28T11:48:30.000Z","size":10076,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-10-19T01:08:43.360Z","etag":null,"topics":["cryptocurrency","discovery","exiftool","geolocation","investigation","metadata","osint","pgp-decryption","pgp-key","reconnaissance"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/achnouri.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-09-26T08:28:11.000Z","updated_at":"2025-09-28T11:48:33.000Z","dependencies_parsed_at":null,"dependency_job_id":"773bad99-6eb4-4e9e-9685-c94545d160f5","html_url":"https://github.com/achnouri/Sakura-CTF-write-up","commit_stats":null,"previous_names":["achnouri/sakura-ctf-write-up"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/achnouri/Sakura-CTF-write-up","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/achnouri%2FSakura-CTF-write-up","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/achnouri%2FSakura-CTF-write-up/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/achnouri%2FSakura-CTF-write-up/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/achnouri%2FSakura-CTF-write-up/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/achnouri","download_url":"https://codeload.github.com/achnouri/Sakura-CTF-write-up/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/achnouri%2FSakura-CTF-write-up/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29616961,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-19T13:04:20.082Z","status":"ssl_error","status_checked_at":"2026-02-19T13:03:33.775Z","response_time":117,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cryptocurrency","discovery","exiftool","geolocation","investigation","metadata","osint","pgp-decryption","pgp-key","reconnaissance"],"created_at":"2025-10-11T19:18:50.002Z","updated_at":"2026-02-19T14:06:07.645Z","avatar_url":"https://github.com/achnouri.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"\n---\n\n# Write-up : \n\n- **Author:** achnouri\n- **Platform:**  Tryhackme   \n- **Challenge Gategory:** Open Source Intellingece    \n- **Challenge Level:** Beginner  \n- **Challenge Name:** Sakura\n- **Challenge Link:** [[challenge link](https://tryhackme.com/room/sakura)]   \n\n\u003cbr\u003e\n\n---\n\nAs the OSINT team, we found ourselves victims of a cyber attack. however due to the mistake of attacker he left an image that our forensic team discovered, and now we must to determine who the attacker is?\n\nThe attacker left a pictiure at [website](https://raw.githubusercontent.com/OsintDojo/public/3f178408909bc1aae7ea2f51126984a8813b0901/sakurapwnedletter.svg) \n\nMy objective is to analyze the website’s source code and the picture to gather information about the attacker\n\nAt First, i visited the [website](https://raw.githubusercontent.com/OsintDojo/public/3f178408909bc1aae7ea2f51126984a8813b0901/sakurapwnedletter.svg), i saw a picture with pink and white colors, containing the text \"You've Been Pwned\" and binaries in the background\n\n\n![The picture that the attacker left behind](./sakurapwnedletter.svg)\n\n---\n\n\u003cbr\u003e\n\n# Extracted and Obtained Data : \n\n\n**After analyzing the website source code and using exiftool, i obtained the following information:**\n\n1-\n\n```bash\nexiftool sakurapwnedletter.svg\n\nExifTool Version Number         : 12.52\nFile Name                       : sakurapwnedletter.svg\nFile Size                       : 850 kB\nMIME Type                       : image/svg+xml\nXmlns                           : http://www.w3.org/2000/svg\nSVG Version                     : 1.1\nID                              : svg8\nVersion                         : 0.92.5 (2060ec1f9f, 2020-04-08)\nDocname                         : pwnedletter.svg\nExport-filename                 : /home/SakuraSnowAngelAiko/Desktop/pwnedletter.png\nMetadata ID                     : metadata5\nWork Format                     : image/svg+xml\nWork Type                       : http://purl.org/dc/dcmitype/StillImage\n```\n\n\u003cbr\u003e\n\n---\n\n1-\n\n```bash\n    inkscape:export-filename=\"/home/SakuraSnowAngelAiko/Desktop/pwnedletter.png\"\n```\n- The name/nickname that attacker uses :  `SakuraSnowAngelAiko`\n\n2-\n\n- **Extracted binaries : (2 blocks) :**\n\n```bash\n11010110101101111101    |   01000001 00100000 01110000\n10101101111110110101    |   01101001 01100011 01110100\n01111011000001010101    |   01110101 01110010 01100101\n01101110010111010110    |   00100000 01101001 01110011\n11011011011011110111    |   00100000 01110111 01101111\n01101111000011010101    |   01110010 01110100 01101000\n01101011010110101011    |   00100000 00110001 00110000\n00011010101011011110    |   00110000 00110000 00100000\n10101101010101101101    |   01110111 01101111 01110010\n01101101010101101011    |   01100100 01110011 00100000\n01101011101101101101    |   01100010 01110101 01110100\n01101101101011110111    |   00100000 01101101 01100101\n11010110101101111101    |   01110100 01100001 01100100\n10101101111110110101    |   01100001 01110100 01100001\n01111011000001010101    |   00100000 01101001 01110011\n01101110010111010110    |   00100000 01110111 01101111\n11011011011011110111    |   01110010 01110100 01101000\n01101111000011010101    |   00100000 01100110 01100001\n01101011010110101011    |   01110010 00100000 01101101\n00011010101011011110    |   01101111 01110010 01100101\n10101101010101101101    |\n01101101010101101011    |\n01101011101101101101    |\n01101101101011110111    |\n```\n---\n\n\u003cbr\u003e\n\nI analyzed the `binaries` from the background of picture (these binaries found at two places : in the image’s background and in the website’s source code) By translating them to text using this online [`tool`](https://www.rapidtables.com/convert/number/binary-to-ascii.html), I obtained the following message:\n\n```bash\n01000001 00100000 01110000 : A p\n01101001 01100011 01110100 : ict\n01110101 01110010 01100101 : ure\n00100000 01101001 01110011 :  is\n00100000 01110111 01101111 :  wo\n01110010 01110100 01101000 : rth\n00100000 00110001 00110000 :  10\n00110000 00110000 00100000 : 00 \n01110111 01101111 01110010 : wor\n01100100 01110011 00100000 : ds \n01100010 01110101 01110100 : but\n00100000 01101101 01100101 :  me\n01110100 01100001 01100100 : tad\n01100001 01110100 01100001 : ata\n00100000 01101001 01110011 :  is\n00100000 01110111 01101111 :  wo\n01110010 01110100 01101000 : rth\n00100000 01100110 01100001 :  fa\n01110010 00100000 01101101 : r m\n01101111 01110010 01100101 : ore\n```\n\n```bash\nA picture is worth 1000 words but metadata is worth far more\n```\n\n3 -\n\n- **Search for abtained name/nickname**\n\n```bash\n    inkscape:export-filename=\"/home/SakuraSnowAngelAiko/Desktop/pwnedletter.png\"\n```\n- From this path obtained from the website’s source code, i searched the name/nickname SakuraSnowAngelAiko in a web browser and found :\u003cbr\u003e\u003cbr\u003e\n\n- Attacker Twitter [account](https://x.com/SakuraLoverAiko)\u003cbr\u003e\n- Attacker Github [account](https://github.com/sakurasnowangelaiko)\u003cbr\u003e\n- Attacker Linkedin [account](https://www.linkedin.com/in/sakuraaiko/)\u003cbr\u003e\n\n\u003cbr\u003e\n\n---\n\n4 -\n\n- **Twitter username     :** `SakuraLoverAiko` \u003cbr\u003e\n- **Twitter profile name :** `Aiko`\u003cbr\u003e\n- **Twitter profile picture** : [picture](https://x.com/SakuraLoverAiko/photo)\u003cbr\u003e\n- **Date joined twitter :** Joined January 2021\u003cbr\u003e\n- **Following : (one) :** micorosoft account\u003cbr\u003e\n- **Twitter-2 username  :** `AiKOABE3`\u003cbr\u003e\n- **Twitter-2 profile name :** Ai\u003cbr\u003e\n- **Twitter-2 profile picture :** [picture](https://x.com/AiKOABE3/photo)\u003cbr\u003e\n- **Date joined twitter-2  :** on October 2022\u003cbr\u003e\n- **Date joined github :** on January 23, 2021\u003cbr\u003e\n- **Programming language :** Assembly, C, C++, Java, Python\u003cbr\u003e\n\n---\n\n5 -\n- **Real name and second twitter account:** A post at `4:56 AM · Jan 30, 2021` the attacker said \"Hi there! I'm \n@AikoAbe3!\" was the second twitter account\n    - With the highest probability, the real name is: `AikoAbe3`\n\n6 -\n\n- **location 1 :**\u003cbr\u003e\n\n    - The post shared at `3:54 PM · Jan 25, 2021` contains a picture that is easy to search for\n    - \u003cimg src=\"./sakutra_relaxing_place.png\" alt=\"sakura_map\" width=\"350\" height=\"470\"/\u003e\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e\n\n    - I searched in map and i found the place `JAL Sakura Lounge, Kawasaki, Japan` besides `Haneda Airport `\u003cbr\u003e\u003cbr\u003e\n    - \u003cimg src=\"./sakura_relaxing_place_airport_map.png\" alt=\"sakura_map\" width=\"750\" height=\"550\"/\u003e\u003cbr\u003e\u003cbr\u003e\n\n---\n\n7 -\n\n- **location 2  :** \u003cbr\u003e\u003cbr\u003e The post shared at `4:57 PM · Jan 25, 2021` it has an anonymous map :\u003cbr\u003e\u003cbr\u003e\n\n    - \u003cimg src=\"./sakura_anounymous_map.jpeg\" alt=\"sakura_map\" width=\"800\" height=\"300\"/\u003e\u003cbr\u003e\u003cbr\u003e\n    - \u003cimg src=\"./sakura_lake.png\" alt=\"sakura_map\" width=\"800\" height=\"300\"/\u003e\u003cbr\u003e\u003cbr\u003e\n\n    - After searching i found the location : `Sado, Niigata, Japan` and the name of lake `lake inawashiro`\u003cbr\u003e\u003cbr\u003e\n\n---\n\n8 -\n\n- **location 3  :** \u003cbr\u003e\u003cbr\u003e The post shared at `11:33 PM · Jan 24, 2021` contains a picture with a message `Checking out some last minute cherry blossoms before heading home!` :\u003cbr\u003e\u003cbr\u003e\n\n    - \u003cimg src=\"./sakura_travel.jpeg\" alt=\"sakura_map\" width=\"800\" height=\"500\"/\u003e\u003cbr\u003e\u003cbr\u003e\n    \n    - \u003cimg src=\"./sakura_check1.png\" alt=\"sakura_map\" width=\"250\" height=\"180\"/\u003e\n    - [first_check](https://en.wikipedia.org/wiki/Washington_Monument) : Washington Monument\u003cbr\u003e\u003cbr\u003e\n    \n    - \u003cimg src=\"./sakura_check2.png\" alt=\"sakura_map\" width=\"250\" height=\"180\"/\u003e\n    - [second_check](https://en.wikipedia.org/wiki/Washington,_D.C.) : Washington, D.C\u003cbr\u003e\u003cbr\u003e\n\n    - Places: (USA) (Washington) (Washington Monument) (Washington, D.C)\n    - The closest airport of Washington Monument and Washington, D.C is : `Ronald Reagan Washington National Airport (DCA)`\n\n\u003cbr\u003e\u003cbr\u003e\n\n---\n\n9 -\n\n- **MD5 hashes :** \n    \n    \u003cbr\u003e\n\n    - New hash : the post shared at `2:47 AM · Jan 24, 2021` contains a md5-hash : `0a5c6e136a98a60b8a21643ce8c15a74`\n\n    - \u003cimg src=\"./Old_hash_.png\" width=\"600\" height=\"200\"\u003e\u003cbr\u003e\u003cbr\u003e\n\n    \n    - I used [my-md5-hasing-tool](https://github.com/achnouri/Smart_Hash_Cracker) which I developed in Python last year to check and decrypt the hash\u003cbr\u003e\u003cbr\u003e\n    - [click to see tool](https://github.com/achnouri/Smart_Hash_Cracker)\n\n        - After using the hashing tool to decrypt the hash, i obtained the following result : \u003cbr\u003e\u003cbr\u003e\n\n            - Hash  `0a5c6e136a98a60b8a21643ce8c15a74` :\n\n            - The type of hash   : MD5 hash\n            \n            - The lenght of hash : 32 characters\n            \n            - Result  of the decryption : `0a5c6e136a98a60b8a21643ce8c15a74` : : \n                ```bash\n                ------------------------------------------------------------------------------\n                    School WiFi Computer Lab:      GTRI-Device              GTgfettt4422!@\n                    Mcdonalds:                     Buffalo-G-19D0-1         Macdonalds2020\n                    School WiFi:                   GTvisitor                GTFree123\n                    City Free WiFi:                HIROSAKI_Free_Wi-Fi      H_Free934!\n                    Home WiFi:                     DK1F-G                   Fsdf324T@@\n                ------------------------------------------------------------------------------\n\n    - Then i located him  : \u003cbr\u003e\n\n    - Based on these outputs, i extracted the `SSIDs` and their `passwords`.\n\n    - And by using [Wigle](https://wigle.net/), i found the `BSSID` for this `SSID: DK1F-G`, which corresponds to the `home Wi-Fi` \n    \n    \u003cbr\u003e\n\n    - \u003cimg src=\"./wigle_map_bssid_search.png\" width=\"900\" height=\"350\"\u003e\u003cbr\u003e\u003cbr\u003e\n\n    - **I found its location :** `hirosaki city`\u003cbr\u003e\u003cbr\u003e\n\n    - \u003cimg src=\"./found_.png\" width=\"900\" height=\"350\"\u003e\u003cbr\u003e\u003cbr\u003e\n\n\u003cbr\u003e\u003cbr\u003e\n\n---\n\n10 -\n\n- **Crypto Wallet [Ethereum]:**\n\n    - MRO : `472haywQKoxFzf7asaQ4XKBc2foAY4ezk8HiN63ifW4iAbJiLnfmJfhHSR9XmVKw2WYPnszJV9MEHj9Z5WMK9VCNHaGLDmJ`\u003cbr\u003e\n    - BTC :`139QWoktddChHsZMWZFxmBva4FM96X2dhE`\u003cbr\u003e\n    \n    - Repo link : https://github.com/sakurasnowangelaiko/ETH.git\n\n    - Repo content : Stratum mining URL : `stratum://ethwallet.workerid:password@miningpool:port`\u003cbr\u003e\n\n    - But this repo has two commits and i must to check them both : \n\n        - Last commit content : `stratum://ethwallet.workerid:password@miningpool:port`\u003cbr\u003e\n        - First commit content : `stratum://0xa102397dbeeBeFD8cD2F73A89122fCdB53abB6ef.Aiko:pswd@eu1.ethermine.org:4444`\u003cbr\u003e\u003cbr\u003e\n\n```bash\n    git clone https://github.com/sakurasnowangelaiko/ETH.git\n    \n    cd ETH\n    \n    cat miningscript\n    stratum://ethwallet.workerid:password@miningpool:port\n    \n    git log\n        commit d507757d5d2208d0124783a8a670239ce19b806c (HEAD -\u003e main, origin/main, origin/HEAD)\n        Author: sakurasnowangel \u003c77871458+sakurasnowangel@users.noreply.github.com\u003e\n        Date:   Sat Jan 23 12:45:39 2021 -0800\n\n            Update miningscript\n\n        commit 5d83f7bb37c2048bb5b9eb29bb95ec1603c40135\n        Author: sakurasnowangel \u003c77871458+sakurasnowangel@users.noreply.github.com\u003e\n        Date:   Sat Jan 23 12:44:57 2021 -0800\n\n        Create miningscript\n    \n\n    git checkout 5d83f7bb37c2048bb5b9eb29bb95ec1603c40135\n    \n    cat miningscript\n    stratum://0xa102397dbeeBeFD8cD2F73A89122fCdB53abB6ef.Aiko:pswd@eu1.ethermine.org:4444\n\n    git switch  main\n```\n- Cryptocurrency wallet address of attacker is : `0xa102397dbeeBeFD8cD2F73A89122fCdB53abB6ef` \u003cbr\u003e And by this crypto wallet address i go to : [etherscan_wesite](https://etherscan.io/) for gather more infomartions\u003cbr\u003e\u003cbr\u003e\n    \n- \u003cimg src=\"./eth_website.png\" width=\"900\" height=\"350\"\u003e\u003cbr\u003e\u003cbr\u003e\n\n- By know wallet addresse i can see more info about this crypto wallet :\n\n    - Balance : how much ETH or ERC‑20 tokens it currently holds\n\n    - Transaction history : incoming and outgoing transactions (amount, timestamp, addresses interacted with)\n\n    - contract interactions : any interactions with contracts (DEXs, NFTs, DeFi)\n\n    - Token holdings : ERC‑20 or ERC‑721 (NFT) tokens associated with the address\n\n    - Publicly linked addresses : i can see other addresses this wallet has sent to or received from\u003cbr\u003e\u003cbr\u003e\n\n- \u003cimg src=\"./wallet.png\" width=\"900\" height=\"350\"\u003e\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e\n\n- I imported a `csv` file of this wallet transactions (42 Transactions) : [`FULL_TRANSACTIONS_CSV_FILE`](./Full_export-0xa102397dbeeBeFD8cD2F73A89122fCdB53abB6ef.csv)\n\n- Mining pool from which the attacker received payments on January 23, 2021 (UTC):\n\n- \u003cimg src=\"./scrreen_vscode_csv.png\" width=\"900\" height=\"350\"\u003e\u003cbr\u003e\u003cbr\u003e\n- \u003cimg src=\"./see_more_details.png\" width=\"900\" height=\"350\"\u003e\u003cbr\u003e\u003cbr\u003e\n- \u003cimg src=\"./details_.png\" width=\"900\" height=\"350\"\u003e\u003cbr\u003e\u003cbr\u003e\n\n- Mining pool from which the attacker received payments on January 23, 2021 : `Ethermine` \n\n\u003cbr\u003e\n\n- \u003cimg src=\"./tether_crypto.png\" width=\"900\" height=\"250\"\u003e\u003cbr\u003e\u003cbr\u003e\n- The attacker exchanged cryptocurrency with other wallets using this wallet : `Tether`\n\n\u003cbr\u003e\u003cbr\u003e\n\n---\n\n11 -\n\n- **Public Key / PGP repo :**\n\n```bash\n    git https://github.com/sakurasnowangelaiko/PGP.git\n\n    cd PGP\n\n    cat publickey\n\n        -----BEGIN PGP PUBLIC KEY BLOCK-----\n    mQGNBGALrAYBDACsGmhcjKRelsBCNXwWvP5mN7saMKsKzDwGOCBBMViON52nqRyd\n    HivLsWdwN2UwRXlfJoxCM5+QlxRpzrJlkIgAXGD23z0ot+S7R7tZ8Yq2HvSe5JJL\n    FzoZjCph1VsvMfNIPYFcufbwjJzvBAG00Js0rBj5t1EHaXK6rtJz6UMZ4n+B2Vm9\n    LIx8VihIU9QfjGAyyvX735ZS1zMhEyNGQmusrDpahvIwjqEChVa4hyVIAOg7p5Fm\n    t6TzxhSPhNIpAtCDIYL1WdonRDgQ3VrtG5S/dTNbzDGdvAg13B8EEH00d+VqOTpu\n    fnR4GnKFep52czHVkBkrNY1tL5ZyYxHUFaSfYWh9FI2RUGQSbCihAIzKSP26mFeH\n    HPFmxrvStovcols4f1tOA6bF+GbkkDj+MUgvrUZWbeXbRvyoKTJNonhcf5bMz/D5\n    6StORyd15O+iiLLRyi5Xf6I2RRHPfp7A4TsuH4+aOxoVaMxgCFZb7cMXNqDpeJO1\n    /idzm0HUkCiP6Z0AEQEAAbQgU2FrdXJhU25vd0FuZ2VsODNAcHJvdG9ubWFpbC5j\n    b22JAdQEEwEKAD4WIQSmUZ8nO/iOkSaw9MXs3Q/SlBEEUAUCYAusBgIbAwUJA8Hp\n    ugULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRDs3Q/SlBEEUP/9C/0b6aWQhTr7\n    0Jgf68KnS8nTXLJeoi5S9+moP/GVvw1dsfLoHkJYXuIc/fne2Y1y4qjvEdSCtAIs\n    rqReXnolyyqCWS2e70YsQ9Sgg0JG4o7rOVojKJNzuHDWQ944yhGk6zjC54qHba6+\n    37F9erDy+xRQS9BSgEFf2C60Fe00i+vpOWipqYAc1VGaUxHNrVYn8FuO1sIRTIo7\n    10LRlbUHVgZvDIRRl1dyFbF8B7oxrZZe9eWQGURjXEVg07nh1V5UzekRv7qLsVyg\n    sTV3mxodvxgw3KmrxU9FsFSKY9Cdu8vN9IvFJWQQj++rnzyyTUCUmxSB9Y/L9wRx\n    4+7DSpfV1e4bGOZKY+KQqipYypUX1AFMHeb2RKVvjK5DzMDq6CQs73jqq/vlYdp4\n    kNsucdZKEKn2eVjJIon75OvE5cusOlOjZuR93+w5Cmf4q6DhpXSUT1APO16R1eue\n    8mPTmCra9dEmzAMsnLEPSPXN5tzdxcDqHvvIDtj8M3l2iRyD6v1NeZa5AY0EYAus\n    BgEMAN4mK70jRDxwnjQd8AJS133VncYT43gehVmkKaZOAFaxoZtmR6oJbiTwj+bl\n    fV1IlXP5lI8OJBZ2YPEvLEBhuqeFQjEIG4Suk3p/HUaIXaVhiIjFRzoxoIZGM1Mh\n    XKRsqc3Zd3LLg1Gir7smKSMv8qIlgnZZrOTcpWX9Qh9Od/MqtCRyg5Rt8FibtKFI\n    Y0j4pvjGszEvwurHqS0Jxxzdd+jOsfgTewFAy1/93scmmCg7mqUQV79DbaDL4JZv\n    vCd3rxX08JyMwdRcOveR3JJERsLN9v8xPv/dsJhS+yaBH+F2vXQEldXEOazwdJhj\n    ddXCVNzmTCIZ85S/lXWLLUa6I1WCcf4s8ffDv9Z3F21Hw64aAWEA+H3v+tvS9pxv\n    I63/4u2T2o4pu/M489R+pV/9W7jQydeE6kCyRDG1doTVJBi1WzhtEqXZ3ssSZXpb\n    bGuUcDLbqgCLLpk62Es9QQzKVTXf3ykOOFWaeqE2aLCjVbpi1AZEQ7lmxtco/M+D\n    VzJSmwARAQABiQG8BBgBCgAmFiEEplGfJzv4jpEmsPTF7N0P0pQRBFAFAmALrAYC\n    GwwFCQPB6boACgkQ7N0P0pQRBFBC3wv/VhJMzYmW6fKraBSL4jDF6oiGEhcd6xT4\n    DuvmpZWJ234aVlqqpsTnDQMWyiRTsIpIoMq3nxvIIXa+V612nRCBJUzuICRSxVOc\n    Ii21givVUzKTaClyaibyVVuSp0YBJcspap5U16PQcgq12QAZynq9Kx040aDklxR/\n    NC2kFS0rkqqkku2R5aR4t2vCbwqJng4bw8A2oVbde5OXLk4Sem9VEhQMdK/v/Egc\n    FT8ScMLfUs6WEHORjlkJNZ11Hg5G//pmLeh+bimi8Xd2fHAIhISCZ9xI6I75ArCJ\n    XvAfk9a0RASnLq4Gq9Y4L2oDlnrcAC0f1keyUbdvUAM3tZg+Xdatsg6/OWsK/dy1\n    IzGWFwTbKx8Boirx1xd5XmxSV6GdxF9n2/KPXoYxsCf7gUTqmXaI6WTfsQHGEqj5\n    vEAVomMlitCuPm2SSYnRkcgZG22fgq6randig/JpsHbToBtP0PEj+bacdSte29gJ\n    23pRnPKc+41cwL3oq8yb/Fhj+biohgIp=grbk\n    -----END PGP PUBLIC KEY BLOCK-----\u003c/details\u003e\u003cbr\u003e\n    \n```\n\n- From this public key I extracted the name/nickname SakuraSnowAngel83 (the key owner) and the associated email domain protonmail.com\n\n- What is PGP ? scroll down to [read more] part\n\n- A tool like gpg can decode the key and display the User ID, key type, key size, fingerprint, and signatures : \u003cbr\u003e\u003cbr\u003e\n\n```bash\ngpg --import publickey\n\n    gpg: key ECDD0FD294110450: public key \"SakuraSnowAngel83@protonmail.com\" imported\n        gpg: Total number processed: 1\n        gpg:               imported: 1\n\n```\n\n```bash\ngpg --list-keys       \n    \n    /home/achnouri/.gnupg/pubring.kbx\n    ---------------------------------\n    pub   rsa3072 2021-01-23 [SC] [expired: 2023-01-22]\n        A6519F273BF88E9126B0F4C5ECDD0FD294110450\n    uid           [expired] SakuraSnowAngel83@protonmail.com\n\n```\n\n```bash\ngpg --list-key --keyid-format LONG --fingerprint  \n\n    /home/achnouri/.gnupg/pubring.kbx\n    ---------------------------------\n    pub   rsa3072/ECDD0FD294110450 2021-01-23 [SC] [expired: 2023-01-22]\n        Key fingerprint = A651 9F27 3BF8 8E91 26B0  F4C5 ECDD 0FD2 9411 0450\n    uid                 [expired] SakuraSnowAngel83@protonmail.com\n```\n\n```bash\ngpg --show-key publickey                         \n    \n    pub   rsa3072 2021-01-23 [SC] [expired: 2023-01-22]\n        A6519F273BF88E9126B0F4C5ECDD0FD294110450\n    uid                      SakuraSnowAngel83@protonmail.com\n    sub   rsa3072 2021-01-23 [E] [expired: 2023-01-22]\n```\n\n\u003cbr\u003e\u003cbr\u003e\n\n---\n\n\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e\n\n\n## TASK 1 : INTODUCTION :\n**nothing, just rewrite the given word**\n\n\u003cbr\u003e\u003cbr\u003e\n\n---\n\n## TASK 2 : TIP OFF\n\n**Background** \nThe OSINT Dojo recently found themselves the victim of a cyber attack. It seems that there is no major damage, and there does not appear to be any other significant indicators of compromise on any of our systems. However during forensic analysis our admins found an image left behind by the cybercriminals. Perhaps it contains some clues that could allow us to determine who the attackers were?\n\nWe've copied the image left by the attacker, you can view it in your browser [here].\n\n**Instructions**\nImages can contain a treasure trove of information, both on the surface as well as embedded within the file itself. You might find information such as when a photo was created, what software was used, author and copyright information, as well as other metadata significant to an investigation. In order to answer the following question, you will need to thoroughly analyze the image found by the OSINT Dojo administrators in order to obtain basic information on the attacker.\n\nAnswer the questions below\nWhat username does the attacker go by?\n\n\u003cbr\u003e\n\n### TASK-2-QUESTION-ANSWER :\n\nWhat username does the attacker go by?\n\n\u003cdetails\u003e\u003csummary\u003eANSWER\u003c/summary\u003eSakuraSnowAngel83\u003c/details\u003e\n\n\u003cBR\u003e\n\n---\n\n## TASK 3 : RECONNAISSANCE\n\n**Background**\n\n\nIt appears that our attacker made a fatal mistake in their operational security. They seem to have reused their username across other social media platforms as well. This should make it far easier for us to gather additional information on them by locating their other social media accounts. \n\n**Instructions**\nMost digital platforms have some sort of username field. Many people become attached to their usernames, and may therefore use it across a number of platforms, making it easy to find other accounts owned by the same person when the username is unique enough. This can be especially helpful on platforms such as on job hunting sites where a user is more likely to provide real information about themselves, such as their full name or location information.\n\nA quick search on a reputable search engine can help find matching usernames on other platforms, and there are also a large number of specialty tools that exist for that very same purpose. Keep in mind, that sometimes a platform will not show up in either the search engine results or in the specialized username searches due to false negatives. In some cases you need to manually check the site yourself to be 100% positive if the account exists or not. In order to answer the following questions, use the attacker's username found in Task 2 to expand the OSINT investigation onto other platforms in order to gather additional identifying information on the attacker. Be wary of any false positives!\n\n\u003cbr\u003e\n\n### TASK-3-QUESTION-ANSWER :\n\nWhat is the full email address used by the attacker?\n\u003cdetails\u003e\u003csummary\u003eANSWER\u003c/summary\u003eSakuraSnowAngel83@protonmail.com\u003c/details\u003e\n\n\u003cbr\u003e\n\nWhat is the attacker's full real name?\n\u003cdetails\u003e\u003csummary\u003eANSWER\u003c/summary\u003eAiko Abe\u003c/details\u003e\n\n\u003cBR\u003e\n\n---\n\n## TASK 4 : UNVEIL\n\n**Background**\nIt seems the cybercriminal is aware that we are on to them. As we were investigating into their Github account we observed indicators that the account owner had already begun editing and deleting information in order to throw us off their trail. It is likely that they were removing this information because it contained some sort of data that would add to our investigation. Perhaps there is a way to retrieve the original information that they provided? \n\n**Instructions**\nOn some platforms, the edited or removed content may be unrecoverable unless the page was cached or archived on another platform. However, other platforms may possess built-in functionality to view the history of edits, deletions, or insertions. When available this audit history allows investigators to locate information that was once included, possibly by mistake or oversight, and then removed by the user. Such content is often quite valuable in the course of an investigation. In order to answer the below questions, you will need to perform a deeper dive into the attacker's Github account for any additional information that may have been altered or removed. You will then utilize this information to trace some of the attacker's cryptocurrency transactions.\n\n\u003cbr\u003e\n\n### TASK-4-QUESTION-ANSWER :\n\nWhat cryptocurrency does the attacker own a cryptocurrency wallet for?\n\u003cdetails\u003e\u003csummary\u003eANSWER\u003c/summary\u003eEthereum\u003c/details\u003e\n\n\u003cbr\u003e\n\nWhat is the attacker's cryptocurrency wallet address?\n\u003cdetails\u003e\u003csummary\u003eANSWER\u003c/summary\u003e0xa102397dbeeBeFD8cD2F73A89122fCdB53abB6ef\u003c/details\u003e\n\n\u003cbr\u003e\n\nWhat mining pool did the attacker receive payments from on January 23, 2021 UTC?\n\u003cdetails\u003e\u003csummary\u003eANSWER\u003c/summary\u003eEthermine\u003c/details\u003e\n\n\u003cbr\u003e\n\nWhat other cryptocurrency did the attacker exchange with using their cryptocurrency wallet?\n\u003cdetails\u003e\u003csummary\u003eANSWER\u003c/summary\u003eTether\u003c/details\u003e\n\n\u003cbr\u003e\u003cbr\u003e\n\n---\n\n## TASK 5 : TAUNT\n\n**Background**\nJust as we thought, the cybercriminal is fully aware that we are gathering information about them after their attack. They were even so brazen as to message the OSINT Dojo on Twitter and taunt us for our efforts. The Twitter account which they used appears to use a different username than what we were previously tracking, maybe there is some additional information we can locate to get an idea of where they are heading to next?\n\nWe've taken a screenshot of the message sent to us by the attacker, you can view it in your browser here.\n\n**Instructions**\n\nAlthough many users share their username across different platforms, it isn't uncommon for users to also have alternative accounts that they keep entirely separate, such as for investigations, trolling, or just as a way to separate their personal and public lives. These alternative accounts might contain information not seen in their other accounts, and should also be investigated thoroughly. In order to answer the following questions, you will need to view the screenshot of the message sent by the attacker to the OSINT Dojo on Twitter and use it to locate additional information on the attacker's Twitter account. You will then need to follow the leads from the Twitter account to the Dark Web and other platforms in order to discover additional information.\n\n\u003cbr\u003e\n\n### TASK-5-QUESTION-ANSWER :\n\nWhat is the attacker's current Twitter handle?\n\u003cdetails\u003e\u003csummary\u003eANSWER\u003c/summary\u003eSakuraLoverAiko\u003c/details\u003e\n\n\u003cbr\u003e\n\nWhat is the BSSID for the attacker's Home WiFi?\n\u003cdetails\u003e\u003csummary\u003eANSWER\u003c/summary\u003e84:af:ec:34:fc:f8\u003c/details\u003e\n\n\u003cbr\u003e\n\n---\n\n## TASK 6 : HOMEBOUND\n\n**Background**\nBased on their tweets, it appears our cybercriminal is indeed heading home as they claimed. Their Twitter account seems to have plenty of photos which should allow us to piece together their route back home. If we follow the trail of breadcrumbs they left behind, we should be able to track their movements from one location to the next back all the way to their final destination. Once we can identify their final stops, we can identify which law enforcement organization we should forward our findings to.\n\n**Instructions**\nIn OSINT, there is oftentimes no \"smoking gun\" that points to a clear and definitive answer. Instead, an OSINT analyst must learn to synthesize multiple pieces of intelligence in order to make a conclusion of what is likely, unlikely, or possible. By leveraging all available data, an analyst can make more informed decisions and perhaps even minimize the size of data gaps. In order to answer the following questions, use the information collected from the attacker's Twitter account, as well as information obtained from previous parts of the investigation to track the attacker back to the place they call home.\n\n\u003cbr\u003e\n\n### TASK-6-QUESTION-ANSWER :\n\nWhat airport is closest to the location the attacker shared a photo from prior to getting on their flight?\n\u003cdetails\u003e\u003csummary\u003eANSWER\u003c/summary\u003eDCA\u003c/details\u003e\n\n\u003cbr\u003e\n\nWhat airport did the attacker have their last layover in?\n\u003cdetails\u003e\u003csummary\u003eANSWER\u003c/summary\u003eHND\u003c/details\u003e\n\n\u003cbr\u003e\n\nWhat lake can be seen in the map shared by the attacker as they were on their final flight home?\n\u003cdetails\u003e\u003csummary\u003eANSWER\u003c/summary\u003elake inawashiro\u003c/details\u003e\n\n\u003cbr\u003e\n\nWhat city does the attacker likely consider \"home\"?\n\u003cdetails\u003e\u003csummary\u003eANSWER\u003c/summary\u003e\u003c/details\u003e\n\n\u003cbr\u003e\n\n## [+] Read More :\n\nPGP (Pretty Good Privacy):\n\n    Purpose: \n        Encrypts messages/files and verifies signatures to ensure privacy and authenticity.\n\n    Key system: \n        Uses public/private key pairs:\n            Public key: Share with others so they can encrypt messages to you or verify your signatures.\n            Private key: Keep secret; used to decrypt messages and sign data.\n    Common uses:\n        Sending encrypted emails\n        Signing software or documents\n        Securing communications\n    Safety:\n        Sharing your public key is safe; only the private key must be protected.\n\n\nSSID (Service Set Identifier) :\n    \n    The network name broadcast by a wifi access point\n\nBSSID (Basic Service Set Identifier) :\n    \n    The access point’s unique MAC address (hardware identifier) for that SSID\n\nfor example at this challenge : `SSID: DK1F-G` and `BSSID: 00:11:22:33:44:55`\n\n\u003cbr\u003e\u003cbr\u003e\n\n**SKILLS : (in this challenge)**\n\n    - Search and discovery\n    - Social media investigation\n    - Metadata \u0026 file analysis\n    - Geolocation and mapping\n    - Cryptocurrency tracing (basic level)\n    - PGP / key analysis\n    - Inscpecting source code\n    ...\n\n**Tools \u0026 services (in this challenge)**\n\n    (exiftool, gpg, hash-tool, strings, Google Maps, OpenStreetMap, Wigle, SunCalc, Google lens, etherscan ...)\n\n\u003cbr\u003e\u003cbr\u003e\n\n---\n\n## Disclaimer\n\nThis write-up is for educational purposes only. All techniques, tools, and methods demonstrated here were used in a legal training environment (CTF/OSINT challenge)\nThe author assumes no liability for misuse\n\u003cbr\u003e\n\n###### This write-up was created by [`@achnouri`](https://github.com/achnouri)\n\n---\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fachnouri%2Fsakura-ctf-write-up","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fachnouri%2Fsakura-ctf-write-up","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fachnouri%2Fsakura-ctf-write-up/lists"}