Published by: Kian Technologies 

Category: OSINT / SOCMINT

Also Read: Uncovering the Invisible: Web OSINT TryHackMe Walkthrough

Difficulty: Easy

ADVERTISEMENT

Date Completed: 25th July 2026

 

Challenge Overview

  • Challenge Name: The Brochure

  • Category: Open Source Intelligence (OSINT)

  • Difficulty: Easy

Introduction & Summary

The journey begins with Day 00 of the Hacker Holiday challenge. This introductory task focuses heavily on Open Source Intelligence (OSINT), specifically testing our ability to analyze downloadable media assets and apply Social Media & Username Intelligence (SOCMINT) techniques to extract hidden flags.

Step-by-Step Walkthrough

Step 1: Initial Asset Analysis & File Inspection

The challenge provides a downloadable task file—a promotional brochure for the fictional Byte Lotus Hotel, saved as a .png image file.

  • Initial Approach: Upon opening the brochure, the first instinct was to inspect the image visually for watermarks, embedded text, or subtle clues. Finding nothing obvious on the surface, the file properties and metadata were analyzed to check for hidden comments or details, which unfortunately yielded no results.

Step 2: Spotting the OSINT Clue & SOCMINT Pivot

Shifting gears toward standard OSINT methodologies, a closer look at the brochure revealed a subtle text hint:

"Find us on Instagram... or not."

Acting on this lead:

  1. A search was conducted on Instagram for Byte Lotus Resort, leading to the official account: @thebytelotusresort.

  2. At the time of analysis, the profile featured two posts. More importantly, checking its "Following" list revealed that the account followed exactly one other profile: @veratheconcierge.

Step 3: Enumerating the Target Profile

Navigating to @veratheconcierge, the profile contained three distinct posts. Each post displayed a unique string composed of uppercase letters, lowercase letters, numbers, and symbols (Base64 signature format):

  • Part 1: VEhNe1YzckBzX2FD

  • Part 2: QzB1bnRfaDRzX2Iz

  • Part 3: M25fZjB1bmQhfQ==

Step 4: Decoding and Extracting the Flag

Recognizing the character pattern as Base64 encoding, each string was processed using an online decoder (such as base64decode.org).

  • Decoding the three segments individually and combining them sequentially yields the complete flag structure:

    • VEhNe1YzckBzX2FD $\rightarrow$ THM{V3r@s_aC

    • QzB1bnRfaDRzX2Iz $\rightarrow$ C0unt_h4s_b3

    • M25fZjB1bmQhfQ== $\rightarrow$ 3n_f0und!}

  • Final Assembled Flag: THM{V3r@s_aCC0unt_h4s_b33n_f0und!}

Flag Status

Note: To avoid active spoilers during the ongoing event, the exact decoded flag format is shared for educational breakdown above.

Key Takeaways & Lessons Learned

  • The Power of OSINT: This challenge demonstrates that even a seemingly innocent marketing asset like a hotel brochure can leak critical breadcrumbs (such as linked social media handles or indirect references).

  • SOCMINT Integration: Attackers or investigators often map out relationships (followers/following lists) to move from a primary target to secondary assets.

  • Best Practice: Always evaluate peripheral details—social footprints, asset metadata, and embedded text references—during reconnaissance phases.

    Also Read: Cracking the Matrix: Mr. Robot CTF Walkthrough

Stay tuned as we roll out the walkthrough for Day 01 next!

Hackers find a way; ethical hackers find a better way.

- Unknown