Hello everyone, I'm back again! Today I competed in Thailand's latest CTF competition - Hack The Scammer CTF 2025.
This round I placed 6th.
Today I'm writing up the one challenge with the fewest solves in the OSINT category:
(Scenario 2 Part 2 - Dark Web Monitoring) - 48 solves. Let's go.
The challenge:
Author: longcat
An Apple ID account belonging to an STH employee (s*********w@sth.sh) was hacked and the password was leaked on the Dark Web. What is the password?
Flag Format: STH{<MD5 of the found password, all lowercase>}
First I searched Google for the email from the challenge: s*********w@sth.sh - nothing.
So I turned to a TI (threat intelligence) platform - SOC Radar (https://socradar.io/). Clicked Free Tools.
Found it - there was indeed a leak.
To get the exact email I turned to dehashed.
Running the email through SOCRadar revealed a partial password.
Next I checked against dehashed directly - SOCRadar had taken me as far as it could go.
To view the full data you need to pay.
You might expect me to switch to a different site - but no, I solved it with money. Paid, done.
After paying, I had the password (D*********r).
Hash it with MD5, submit - making sure to match the exact flag format.
Flag Format: STH{<MD5 of the found password, all lowercase>}
Final: STH{REDACTED}
That's a wrap for this write-up. Other challenges - I'll leave those to someone else. Bye! And as tradition dictates, here's a meme.
- - - - - - - - See you next time - - - - - - - -
Profile
Sabastiaz
Medium : https://medium.com/@sabastiaz
LinkedIn: https://www.linkedin.com/in/ratthapong-sommanus-465b661b2/
