Challenge: 

Name: Reset Uvogin’s Password

Description: Reset Uvogin’s password via the Forgot Password mechanism with the original answer to his security question.

Difficulty: 4 star

Category: Sensitive Data Exposure

Expanded Description: https://pwning.owasp-juice.shop/part2/sensitive-data-exposure.html

Tools used:

Sherlock, Wayback Machine

Resources used:

Solution Guide

Methodology: 

This challenge was fun, informative, and remarkably complex. The first step, as always, was to check the expanded description, which referenced the fact that “People often reuse aliases online.” So I looked into aliases for Uvogin.

With four potential names to look into, I got to work scouring the internet. I can’t read Kanji, so I limited my scope to Uvogin, Ubogin, and Wbererguin. Despite over an hour of searching, and asking all of the anime fans in my life for tips, I came up dry, so I broke out the Solution Guide, which pointed me to Sherlock. Sherlock, for those who aren’t familiar, is a fantastic tool for scouring social media platforms to search for usernames. I’ve used Sherlock dozens of times over the last year or so, both to show my friends how much of their lives can be aggregated almost instantaneously and to locate forgotten accounts of my own so I can either update the privacy settings or delete them outright.

In this case, however, there was a bit of an issue: the sheer volume of accounts using Uvogin name and/or aliases. Despite being unemployed at the moment, I still didn’t have the available time to search each and every one of these links for hints.

Back to the Solution Guide I went, finding the alias I would need to search for (uv0gin), as well as the domain to seek out (Twitter).

Great. Only one tweet. Using the Wayback Machine, however, there was an archived version of this page dating back to April of this year.

Upon loading that archived page, I was met with the solution to this challenge. Then it was just a matter of filling out the Forgotten Password form and changing Uvogin’s password.

Prevention and Mitigation Strategies:

OWASP Security Question Cheat Sheet

Lessons Learned and Things Worth Mentioning:

Sherlock, while somewhat unstable at times, is a fantastic tool and is a fun way to show your friends why they should spend the time necessary to change privacy settings on their social media accounts. From EXIF data to social connections and long forgotten posts on disused platforms, Sherlock will aggregate websites with a treasure trove of personal data in mere seconds.