ID Exposed

Have to find last location of the person in question . Have there email address .

sherlock gave some results but they didnt pan out .

the challenge says id exposed. can try to find out her gmail id and then check her google photos and such .

found out the google id by adding the email to contact and spoofing from the source code of the application using developer tools . amazing resource about how this works and what all can be tracked with it is here

Everybody who owns a Google account may not be aware of it, but Google uses a lot of different numbers, ID’s, signatures, account names, randomly chosen gobbledygook and meaningless strings to identify your account. Not everything can be tied together in an easy way, but there are a few handy shortcuts when you are looking at Gmail addresses or a YouTube account for instance. I am not able to do this in bulk yet, but I know there are people out there that might be able to make that happen.

have a public api for google which will give us info about the person when called with the google id .

data-personid = c301569479640700229

now to get the actual google id we have to make a call to people.google.com because its a private data . this is the api call which should work .

1

curl https://people.googleapis.com/v1/people/c301569479640700229?personFields=metadata?key=GOOGLE_CLOUD_KEYS

after getting the google id can take a look at the ‘contributions’ that a GoogleID has made to Google Maps. This means reviews and photos, for the most part. Certainly the kind of data that would tick the boxes of what this CTF solution asks of us.

So, I tack the GoogleID onto the appropriate URL…

https://www.google.com/maps/contrib/117395327982835488254/

1

really nice museum %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%5%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%HTB{i_W4S_D_I_S_c_O_v_3_R_3_D}%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

which also contains the flag