Vulnmachines OSINT Series - Complete Writeup (All 6 Flags)
Challenge Info
- Platform: Vulnmachines
- Category: OSINT (Open Source Intelligence)
- Series: 5 challenges, 6 flags
- Challenge link: https://account.vulnmachines.com/user/challenges
- Description: "OSINTOrg has created some cool badges. You need to perform an open-source intelligence assessment on their organization and find out about their internet presence and employee information to get the flags and the cool badges."
- Note: OSINT is a really fun hands-on exploration process. I'd recommend giving it a shot yourself before reading on.
Initial Analysis and Strategy
Starting from Scratch
After receiving the challenge, all we know is:
- There's an organization called OSINTOrg
- They've made some badges
- We need to investigate their internet footprint and employee information
OSINT Lab 1, 2
Goal: Find the organization's social media accounts and employee profiles
Step 1: Use a Username Checker Tool
First, let's run an automated search using NameCheckerr:
Visit: https://namecheckerr.com/
Enter: OSINTOrg
Results analysis:
✅ Registered:
- Twitter/X: @OSINTOrg
- GitHub: github.com/osintorg
Step 2: Dig into Twitter
Visit https://twitter.com/OSINTOrg
Key findings:
Organization account: @OSINTOrg
Followers include employees:
- Alex Mason (@Al3xM4s0n) - Bio: "Tech Lead @OSINTOrg"
- Emily (@Emily_Tech_) - Bio: "SDE Intern @OSINTOrg"
Step 3: Analyze Employee Interactions
Check out Alex Mason's tweets:
Alex Mason @Al3xM4s0n
We would to let you know that we have started our development journey for @osintorg.
Visit our GitHub profile here: https://github.com/orgs/osintorg/dashboard
Emily's reply reveals the organization's structure and division of work, and flag1 can be found in the comments.
We would to let you know that we have started our development journey for @osintorg. Visit our GitHub profile here: https://t.co/QVygQzlKBN
— Alex Mason (@Al3xM4s0n) January 17, 2023
Step 4: Explore the GitHub Organization
Visit the GitHub organization page:
https://github.com/osintorg
Members discovered:
emilyosintorg- Emily's GitHub accountalexosintorg- Alex Mason's GitHub account
Step 5: Gist Recon
OSINT tip: developers often share code snippets in Gists, which may contain sensitive information.
Visit Emily's Gists:
https://gist.github.com/emilyosintorg
We find favicon.js:
Key: check the comments section! That's where flag2 is.
OSINT Lab 3 - Finding Secrets
Goal: Find the hosted service (Jenkins) and enumerate it
Step 1: Analyze the Clues in the Gist
Back in Emily's favicon.js Gist, there's another comment from Alex:
The Jenkins URL is now set to: osintorg-{github-username}-prod.domain-name
Step 2: Construct the Jenkins URL
Based on the format, the possible URLs are:
osintorg-emilyosintorg-prod.osintorg.com
osintorg-alexosintorg-prod.osintorg.com
Step 3: Port 8080
Jenkins's default port is 8080:
# Test with a browser or curl
http://osintorg-emilyosintorg-prod.osintorg.com:8080/
Success! The Jenkins instance is accessible without authentication.
Step 4: Jenkins Enumeration
Navigation path:
Jenkins home → left-hand menu → Credentials
What we find on the Credentials page:
Domain: (global)
ID: vnm{open_things_can_lead_to_more_open_things}
Name: vnm{open_things_can_lead_to_more_open_things}
Type: Username with password
flag3 is right here.
Bonus find: a hint telling you where to grab the full-access flag
Another Credential:
ID: d9ffec32-ef0d-4fcc-aeff-1dabbe70aeb9
Name: FullBadgeAccess
Description: Get full badge access from bucket badge-fullaccess.amazon.com
OSINT Lab 4 - Cloud Asset Discovery
Goal: Identify cloud assets
Step 1: Check the Jenkins Build Logs
Click prod-env-jenkins → Build History → #8 → Console Output
Key info in the logs:
Publish artifacts to S3 Bucket Using S3 profile: s3-osint-jenkins
Step 2: S3 Bucket Enumeration
Method 1: Access via browser
https://s3-osint-jenkins.s3.amazonaws.com/
XML response:
<Contents>
<Key>FLAG.txt</Key>
<LastModified>2023-06-26T08:58:55.000Z</LastModified>
</Contents>
https://s3-osint-jenkins.s3.amazonaws.com/FLAG.txt
That's flag4.
Badge Hacking - The Combined Challenge
Limited Access Badge -
The Early Struggle
So far we've found:
- Emily (emilyosintorg)
- Alex Mason (alexosintorg)
But the Limited Access flag just wouldn't turn up...
The Breakthrough: Look for Other Employees
Expanded search strategy:
Original pattern:
- emilyosintorg
- alexosintorg
Found AlexbadgeOsintOrg — spotted in the company's follower list!
https://github.com/AlexbadgeOsintOrg
This is another Alex account, dedicated specifically to badge-related development!
Check the Repository
Repository: badge
Commit: Create Limited Badge Access (4aba24c)
https://github.com/AlexbadgeOsintOrg/badge/commit/4aba24c
The flag is right there in the commit contents!
🚩 Flag 5: Limited Access Badge flag
Full Access Badge
Step 1: Find More Clues
During the search, Emily's Gist turned up a JavaScript file containing an S3 link:
262588213843476
//jenkins badge-access: https://badge-fullaccess.s3.amazonaws.com/
import React, { useEffect, useState } from 'react'
// ... code contents ...
Step 2: Access the S3 Bucket
https://badge-fullaccess.s3.amazonaws.com/
XML response:
<Contents>
<Key>s3cr3t.txt</Key>
<LastModified>2023-01-17T09:07:45.000Z</LastModified>
</Contents>
Step 3: Grab the Flag
https://badge-fullaccess.s3.amazonaws.com/s3cr3t.txt
🚩 Flag 6: Full Access Badge flag
Tools and Techniques Summary
Essential Tools
# Username search
- NameCheckerr (https://namecheckerr.com/)
# GitHub recon
- Direct search: github.com/search
- Gist search: gist.github.com/search
# S3 Bucket exploration
- Browser: https://bucket-name.s3.amazonaws.com/
# Port scanning
- nmap -p 8080 domain.com
- or just test in the browser
Solution Flowchart
OSINTOrg
├── Social Media
│ ├── Twitter → employee accounts → Flag in conversation
│ └── LinkedIn (optional)
├── GitHub
│ ├── Organization → member list
│ └── Gists → Flag in comments + Jenkins clue
├── Jenkins
│ ├── Port 8080
│ ├── Credentials → Flag
│ └── Build Logs → S3 Bucket clue
└── AWS S3
├── s3-osint-jenkins → Flag
└── badge-fullaccess → Flag
Conclusion
This OSINT series cleverly simulates a real-world information-gathering scenario. It starts with the most basic social media searches, gradually works its way into exploring technical assets, and finally requires you to combine every skill to complete the Badge Hacking challenge.
Lessons Learned:
The most interesting parts of this challenge all revolve around GitHub:
- Searching public Gists
- Using the organization's GitHub to find other company employees
- Being able to view past commits in a repository
And that's a wrap!
Member discussion