Something's Fishy...
- Cyber Catamounts
- Sep 7, 2020
- 2 min read
Briefing
We’ve received intel that a hacker is hiding behind “FishyToni,” and our intelligence specialists haven’t been able to uncover any new findings with this name. Maybe you could try using the resources you have access to in order to try and uncover their secret? One more thing Agent, we’ve also found a random post on a forum from them stating that they like birds that tweet.
Tip: Social media is a big revealer.
Second tip if you’re still stuck: Sometimes accounts hide on google. You might have to go to the social media’s actual website to find our culprit.
TL;DR Google the username, find the profile, get the ALT text of the Caesar Salad image, and decode the flag using ROT13 (caesar cipher rotate 13)
In all challenges, Google is your friend--especially for OSINT!
If you google “FishyToni,”
This pops up!
The bio itself looks pretty suspicious, so I think we’ve found our culprit.
After discovering the target...
Flipping through the posts, we find this comment below a picture of a Caesar Salad:
ALT text? With a quick google we find: https://community.brightspace.com/s/article/Alt-Text-for-Web-Page-Images
To view ALT text, all you have to do is use inspect.
For Chrome, all you have to do is press Ctrl-Shift-I, F12, or right click and select “inspect.”
Use this tool to click on the Caesar Salad to select its HTML code. From there we discover:
<img alt="Encoded flag: UVqVAt_1A_gUR_$NYNq
Hey >:( ! You found me, but you're not done quite yet!" draggable="true" src="https://pbs.twimg.com/media/EemXY-CWAAEYGnU?format=png&name=360x360" class="css-9pa8cd">Great! But as the ALT says, we’re not done yet. Unfortunately, UVqVAt_1A_gUR_$NYNq is not our flag.
What do we do next?
Collect our clues:
There’s a picture of a Caesar Salad
We have an encoded flag
We just found the ALT text
The Caesar Salad is a clue. There’s something called a “Caesar Cipher”
Cyberchef time!
https://gchq.github.io/CyberChef/#recipe=ROT13(true,true,13)&input=VVZxVkF0XzFBX2dVUl8kTllOcQ
Remember, in a Caesar Cipher, you’re rotating the alphabet letters. That’s why it’s ROT13 in Cyberchef (ROT = rotate)
Flag: HIdINg_1N_tHE_$ALAd
Comments