# [Whistle Blower](https://infernoctf.live/challenges#Whistle%20Blower)OSINT,226 Points
Author: nullpxl
Writeup by: **archerrival**
## Description>After playing some 2048 you come across an interesting email exchange... What could it lead to?
```X-Gmail-Labels: Sent,Opened,leakMIME-Version: 1.0Date: Tue, 24 Dec 2019 13:59:13 -0800Subject: Re: Status Regarding Your EmploymentFrom: iam thedeveloper <[email protected]>To: angry employer <[email protected]>Content-Type: multipart/alternative; boundary="0000000000005405a8059a7a4108"
--0000000000005405a8059a7a4108Content-Type: text/plain; charset="UTF-8"
Hello Angry Employer,
I will not stand for this, it was a simple mistake that anyone could havemade.If anything, I should blame your company training!I'm leaking all confidential information, on purpose this time.
Hope you like being the center of attention on infosec twitter!
- imdeveloper123
On Tue, Dec 24, 2019 at 1:54 PM angry employer <[email protected]>wrote:
> Hello Mr. imdeveloper123,>> Are you kidding me? You leaked company info by making the dot-files you> use for work purposes *public* on your GitHub?> It should come at no surprise that as of the time of writing this email,> you are permanently released from your current job.>> Please talk to HR ASAP.>> - Angry Employer>
--0000000000005405a8059a7a4108Content-Type: text/html; charset="UTF-8"Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div>Hello Angry Employer,</div><div></div><div>I will= not stand for this, it was a simple mistake that anyone could have made.==C2=A0 </div><div>If anything, I should blame your company training!=C2==A0 </div><div>I'm leaking all confidential information, on purpose= this time.</div><div></div><div>Hope you like being the center of atte=ntion on infosec twitter!</div><div></div><div>- imdeveloper123=</div></div><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_=attr">On Tue, Dec 24, 2019 at 1:54 PM angry employer <[email protected]> wrote:=</div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;b=order-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr"><d=iv>Hello Mr. imdeveloper123,</div><div></div><div>Are you kidding me? You le=aked company info by making the dot-files you use for work purposes *public=* on your GitHub?=C2=A0 </div><div>It should come at no surprise that a=s of the time of writing this email, you are permanently released from your= current job.=C2=A0 </div><div></div><div>Please talk to HR ASAP.</=div><div></div><div>- Angry Employer</div></div></blockquote></div>
--0000000000005405a8059a7a4108--
MIME-Version: 1.0From: angry employer <[email protected]>Date: Tue, 24 Dec 2019 13:54:14 -0800Subject: Status Regarding Your EmploymentTo: [email protected]Content-Type: multipart/alternative; boundary="00000000000020ca41059a7a30ce"
--00000000000020ca41059a7a30ceContent-Type: text/plain; charset="UTF-8"
Hello Mr. imdeveloper123,
Are you kidding me? You leaked company info by making the dot-files you usefor work purposes *public* on your GitHub?It should come at no surprise that as of the time of writing this email,you are permanently released from your current job.
Please talk to HR ASAP.
- Angry Employer
--00000000000020ca41059a7a30ceContent-Type: text/html; charset="UTF-8"Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div>Hello Mr. imdeveloper123,</div><div></div><div>Are you= kidding me? You leaked company info by making the dot-files you use for wo=rk purposes *public* on your GitHub?=C2=A0 </div><div>It should come at= no surprise that as of the time of writing this email, you are permanently= released from your current job.=C2=A0 </div><div></div><div>Please= talk to HR ASAP.</div><div></div><div>- Angry Employer</div></div>
--00000000000020ca41059a7a30ce--
```
## SolutionWe were able to open the file given with Notepad++. Since this was an OSINT challenge, I looked for things that could be found onlinein public webpages.
```Hope you like being the center of attention on infosec twitter!```
This line hints to look at the twitter page of **imdeveloper123**. Going to https://twitter.com/imdeveloper123, we find that he hasmade two tweets.
![](images/whistleblower1.jpg)
The first tweet hints that we should use Wayback Machine to find an old archived version of his deleted blog. Using the Wayback Machineon the https://iamthedeveloper123.weebly.com/ gives us one snapshot on December 24th. Opening the website gives us the flag.
`infernoCTF{y0u_f0und_7h3_d1sgrun7l3d_empl0y33!}`