SocialMediaInvestigationHub

Technical Walkthrough

Writeup

Challenge

• Name: Social Media Investigation Hub
• Category: OSINT
• Difficulty: Unknown
• Remote: <TARGET>:32046

Summary

The live app is a React/Vite single-page OSINT hub with three mock platforms: ChirpNet, ConnectPro, and ForumHub. Searching TechReviewer2024 exposes linked accounts that identify the operator, prior RivalTech employment, coordinated reviewer network, campaign codename, and target product.

The final solve uses the API's accepted answer formats for all nine questions and requests the final flag.

Artifact Inventory

• analysis/http-index-response.txt: app shell.
• analysis/index.js: frontend bundle with mock social data and API calls.
• analysis/api-start-response.txt: sanitized API question response.
• analysis/platform-evidence.md: extracted cross-platform findings.
• analysis/answer-format-attempts.txt: accepted answer validation.
• solve/solve.py: reproducible API solve.

Analysis

The frontend bundle exposed API routes:

• POST /api/start-challenge
• POST /api/submit-answer
• POST /api/get-flag

It also embedded the mock platform data. The critical cross-platform links were:

• ConnectPro real identity: Alex Morgan.
• ConnectPro prior employer: RivalTech Inc.
• ForumHub coordination post: XyloPhone Pro Campaign Coordination.
• ForumHub codename: operation_social_storm_2024.
• ChirpNet timing: suspicious reviewer accounts clustered around February 2024.

Solve

Run:

python3 solve/solve.py <TARGET> 32046 --save loot/flag.txt

The script starts a session, submits all accepted answers, prints the flag, and optionally saves it to loot/flag.txt.

Flag

Raw flag is stored in loot/flag.txt.

Lessons

• For web-backed OSINT hubs, inspect the frontend bundle before manual UI work.
• Mock social platforms may expose structured data directly in the bundle.
• Save failed answer-format attempts because they reveal the API's expected interpretation of ambiguous questions.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: Social Media Investigation Hub
• Category: OSINT
• Difficulty: Unknown
• Remote instance: <TARGET>:32046
• Start time: 2026-05-11T18:43:33Z
• Operator: Codex

Artifact Inventory

Evidence Ledger

Key Findings

• TechReviewer2024 maps to Alex Morgan through ConnectPro.
• Alex Morgan previously worked for RivalTech Inc..
• ForumHub contains direct XyloPhone Pro campaign coordination and the codename operation_social_storm_2024.
• Cross-platform timing points to February 2024 for suspicious reviewer-account coordination.
• The API's accepted education answer was the institution, not the degree.

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Do not paste them here.

| 2026-05-27T23:35:17Z | backfill | challenge-state.json | Legacy workspace backfilled with deterministic state | High | Validate before further work |

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: OSINT
• Challenge: Social Media Investigation Hub
• Difficulty: Unknown
• Source workspace: <local workspace>

Validated Solve Chain

1. Inspect static React/Vite bundle for API routes and embedded mock social data.
2. Start API session to enumerate exact questions.
3. Correlate TechReviewer2024 across ChirpNet, ConnectPro, and ForumHub.
4. Extract identity, prior employer, campaign codename, target product, account timing, subreddit role, institution, connection count, and karma.
5. Submit accepted answer strings and request final flag.

Reusable Lessons

• Web-backed OSINT hubs can store all social-platform evidence client-side in the JavaScript bundle.
• API explanations after accepted answers are useful evidence and should be saved.
• Ambiguous questions may expect institution rather than degree, or exact platform wording rather than natural-language interpretation.

Dead Ends

• Bachelor of Science in Marketing was rejected for the education question; University of California, Berkeley was accepted.

Tool Quirks

• /robots.txt and /sitemap.xml returned the SPA shell.
• Session cookies and session ids appear in API captures and must be redacted before memory export.

Evidence Paths

• analysis/index.js
• analysis/api-start-response.txt
• analysis/platform-evidence.md
• analysis/answer-format-attempts.txt
• solve/solve.py

Ingestion Decision

• Proposed for LightRAG: yes
• Requires user approval before ingestion: approved for sanitized learning auto-ingest by user instruction
• Ingested into CTF LightRAG: 2026-05-11T19:22:13Z via track scan_20260511_192213_765c608c

Hypothesis Board

Closed Branches