root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat the-suspicious-reviewer.md
// writeups

The Suspicious Reviewer

8 Aug 2025 · 2 min read
writeupshacktheboxchallengeVery Easycat-osintretired
The Suspicious Reviewer — HTB challenge
An OSINT task on a suspicious social profile. The target email is in plain view in the profile's About section — just expand it and format the flag.

Challenge overview

FieldValue
PlatformHack The Box · Challenge
CategoryOSINT
DifficultyVery Easy
StateRetired

Attack map

[Instance] social profile
      │
      ▼
[Profile ▸ About] public info
      │
      ▼
[email] exposed
      │
      ▼
[FLAG] HTB{email}

1. Spin up the instance

It's OSINT with no technical exploitation: connect the VPN, start the challenge and open the IP in the browser.
# OpenVPN ▸ Start Challenge ▸ abrir la IP

2. Analyse the profile

The profile shows a photo, posts and public info. In OSINT, the About section is where contact data concentrates.

3. Extract the email

Expanding About reveals the user's email address directly.
About ▸ alex.morgan@tempmail.com

4. Flag

HTB{alex.morgan@tempmail.com}

Investigation summary

PhaseSourceFinding
ReconSocial profilePhoto, posts, About
ExtractionAbout sectionTarget email → flag

Lessons learned

  • Public contact info is the first thing to check in any OSINT investigation.
  • Don't overthink "Very Easy" challenges — the data is usually in plain view, not hidden.
  • On social media, the About/bio section concentrates emails, sites and locations.