Username Pivoting
osint · easy · +30 XP
Target
GET /api/lab/username-pivot-101/lookup?username=... (mock sherlock-style cross-site lookup)
GET /api/lab/username-pivot-101/profile?site=...&username=... (fetch a profile's public data)
Goal: start from username darkr00t. The lookup tells you which sites it exists on. One of those profiles has an avatar EXIF GPS or a status-message that leaks a secondary handle. Pivot to that handle, fetch its profile, and the bio contains the flag.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/username-pivot-101/
// reuse on the cli
// submit flag
// no solves yet