TheSuspiciousReviewer

Technical Walkthrough

Writeup

Challenge

• Name: The Suspicious Reviewer
• Category: OSINT
• Difficulty: Very Easy

Summary

The target is a static SocialConnect profile page for TechReviewer2024. The About tab hides contact details until Show Contact is selected, but the frontend bundle already contains the underlying profile object. The exposed contact email is the key finding.

Artifact Inventory

• analysis/http-index-response.html: React/Vite shell.
• analysis/index.js: minified bundle containing the profile data.
• analysis/profile-evidence.md: extracted profile/contact evidence.
• analysis/routes.md: route and API behavior notes.

Analysis

The SPA loads /assets/index-fPbXfhd6.js. Searching the bundle for the target username finds the embedded profile object:

username: TechReviewer2024
displayName: Tech Reviewer
location: San Francisco, CA
joinDate: March 15, 2024
email: <email redacted>

The rendered UI only exposes the email after toggling Show Contact; phone and location contact rows remain hidden. No backend answer-checking API is exposed: the prior challenge API routes return the SPA shell for GET and 404 for POST.

Solve

Run:

python3 solve/solve.py <TARGET> 31898 --save loot/flag.txt

The script fetches the SPA shell, locates the Vite bundle, extracts the profile email, and wraps the exact lowercased contact address in HTB flag format.

Flag

Raw flag is stored in loot/flag.txt.

Lessons

• Some very easy OSINT instances are static profile pages, not interactive answer APIs.
• For SPA-only OSINT challenges, inspect the shipped bundle for the same data the UI reveals after clicks.
• Preserve uncertainty when there is no live verifier API; document the derivation path clearly.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: The Suspicious Reviewer
• Category: OSINT
• Difficulty: Very Easy
• Remote instance: <TARGET>:31898
• Start time: 2026-05-11T19:28Z
• Operator: Codex

Artifact Inventory

Evidence Ledger

Key Findings

• TechReviewer2024 maps to display name Tech Reviewer.
• The exposed contact email is <email redacted>.
• Phone and location contact rows are intentionally hidden in the UI.
• Posts target TechFlow/TechFlow Pro; friend names and join dates support astroturfing indicators.
• No live answer-checking API is present on this instance.

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Do not paste them here.

| 2026-05-27T23:35:17Z | backfill | challenge-state.json | Legacy workspace backfilled with deterministic state | High | Validate before further work |

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: OSINT
• Challenge: The Suspicious Reviewer
• Difficulty: Very Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1. Fetch the React/Vite SPA shell and identify the bundled JavaScript asset.
2. Search the bundle for the target username to locate embedded profile, post, friend, and contact data.
3. Confirm API-like routes are static fallbacks or 404 for POST; no live verifier is exposed.
4. Derive the submission candidate from the only exposed contact value, preserving email punctuation inside the HTB wrapper.

Reusable Lessons

• Very Easy social-profile OSINT challenges may be static SPAs with the answer embedded in the frontend bundle.
• UI-hidden contact fields can often be read directly from minified app state constants.
• If no verifier API exists, document the derivation and avoid over-normalizing evidence values that may be expected verbatim.

Dead Ends

• Prior /api/start-challenge, /api/submit-answer, and /api/get-flag workflow was not present on this target.
• Source map and direct flag endpoints did not expose additional data.

Tool Quirks

• In zsh, using path as a loop variable shadows the shell PATH array and breaks command lookup.
• GET requests to unknown paths return the SPA shell, while POST to those paths returns 404.

Evidence Paths

• analysis/index.js
• analysis/profile-evidence.md
• analysis/routes.md
• solve/solve.py

Ingestion Decision

• Proposed for LightRAG: yes
• Requires user approval before ingestion: approved for sanitized learning auto-ingest by user instruction
• Ingested into CTF LightRAG: 2026-05-11T20:13:29Z via corrected track scan_20260511_201329_104b45a2

Hypothesis Board

Closed Branches