Overheard at Breakfast(THM) Walkthrough

Difficulty: Easy Category: OSINT

Overview

Overheard at Breakfast is a TryHackMe OSINT (Open Source Intelligence) challenge where the goal is to analyze a screenshot of a private conversation and use the exposed information to identify a hidden online account.

Investigation

The conversation contains 2 major clues.

The First clue is the mention of a platform that allowed the user to create a profile and link all of their social media accounts in one place. This provides a strong starting point for pivoting to other online accounts.

The Second clue is the user’s email address.

If you search for the platform in clue one online you will get that the platform is Gravatar.

Search Phase: “can you name a free tool that let me upload my profile and link other media account is neat it’s name start with G”

Then I searched for the user’s email address on the site. The search returned a matching profile, which served as a pivot point to the user’s linked online accounts.

If you visit the user’s Profile URL you will get an base64 encoded string.

When you will decode it in Kali Linux Terminal or CyberChef , you will get the flag.

Flag: THM{******_**_**}

Key Takeaways

This room is a direct simulation of a real-world shoulder surfing attack. A single screenshot of a private conversation provides enough information to begin an OSINT investigation and uncover additional online accounts. It also reinforces that attackers don’t always rely on sophisticated tools or technical exploits.