Hello everyone, I'm back again! Today I competed in Thailand's latest CTF competition — Hack The Scammer CTF 2025.
This round I placed 6th.
Today I'm writing up the one challenge with the fewest solves in the OSINT category:
(Scenario 2 Part 2 — Dark Web Monitoring) — 48 solves. Let's go.
The challenge:
Author: longcat
An Apple ID account belonging to an STH employee (s*********w@sth.sh) was hacked and the password was leaked on the Dark Web. What is the password?
Flag Format: STH{<MD5 of the found password, all lowercase>}
First I searched Google for the email from the challenge: s*********w@sth.sh — nothing.
So I turned to a TI (threat intelligence) platform — SOC Radar (https://socradar.io/). Clicked Free Tools.
Found it — there was indeed a leak.
To get the exact email I turned to dehashed.
Running the email through SOCRadar revealed a partial password.
Next I checked against dehashed directly — SOCRadar had taken me as far as it could go.
To view the full data you need to pay.
You might expect me to switch to a different site — but no, I solved it with money. Paid, done.
After paying, I had the password (D*********r).
Hash it with MD5, submit — making sure to match the exact flag format.
Flag Format: STH{<MD5 of the found password, all lowercase>}
Final: STH{REDACTED}
That's a wrap for this write-up. Other challenges — I'll leave those to someone else. Bye! And as tradition dictates, here's a meme.
— — — — — — — — See you next time — — — — — — — —
Profile
Sabastiaz
Medium : https://medium.com/@sabastiaz
LinkedIn: https://www.linkedin.com/in/ratthapong-sommanus-465b661b2/
