Overheard at Breakfast — OSINT Room Walkthrough

Two strangers. One conversation. One profile they never meant to reveal. An OSINT walkthrough on uncovering hidden flags using profile aggregators.

Room Overview

Welcome to Overheard at Breakfast, a pure OSINT challenge on TryHackMe. We are tasked with analyzing a leaked resort conversation, identifying critical contact points, finding linked profile services, and decoding hidden secrets.

🎯 Objectives

Analyze the provided conversation for identifying details
Extract the relevant clues
Locate the hidden account
Submit the flag

Step 1 — Analyze the Conversation

The room provides a Discord-style chat log between two users:

Ponzi (tagged as an Influencer with the L3AK role)
Lambo!

The conversation takes place at a resort called Byte Lotus, which provides the backdrop and context for the email addresses they share.

Step 2 — Extract the Clues

Reading through Lambo!'s messages carefully reveals two critical pieces of information:

Clue 1 — Email Address

Lambo! directly shares their contact email in the chat:

lambobytelotushotel@gmail.com

Clue 2 — The Mystery "G" Tool

Lambo! mentions:

"I used to use this free tool that let me upload my profile and link other media accounts... Started with a G if I remember correctly."

This is a strong hint pointing to a profile-linking service whose name starts with the letter G.

Step 3 — Identify the "G" Tool

Let's map out profile aggregator/linking tools starting with "G":

Tool Name	Description	Likelihood
Gravatar	Free globally recognized avatar service. Links email addresses to social media and profiles.	High (Matches all constraints)
Grav CMS	Flat-file content management system.	Low (Not a profile aggregator)

Gravatar is our clear winner because it maps email hashes to public profile descriptions and external links.

Step 4 — Find the Hidden Profile

Using the extracted email address lambobytelotushotel@gmail.com, we search Gravatar for a profile with the username lambobytelotushotel:

https://gravatar.com/lambobytelotushotel

Visiting this profile, we inspect the public details. In the user's description / about section, we discover a Base64-encoded string:

VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWYzZH0=

Step 5 — Decode the Flag

Now, we decode the Base64 string to retrieve the cleartext flag:

echo "VEhNe1MzY3JlVF9QcjBmaWwzX0g0c19iMzNuX0lkZW50MWYzZH0=" | base64 -d

# Output:
# THM{S3creT_Pr0fil3_H4s_b33n_Ident1f3d}

🎉 FLAG CAPTURED!

THM{S3creT_Pr0fil3_H4s_b33n_Ident1f3d}

Attack Chain Summary

[Chat Log Analysis]
        │
        ▼
[Email Extracted: lambobytelotushotel@gmail.com]
        │
        ▼
[Service Identified: Gravatar]
        │
        ▼
[Profile Located: gravatar.com/lambobytelotushotel]
        │
        ▼
[Base64 Payload Found]
        │
        ▼
[Decoded Flag: THM{S3creT_Pr0fil3_H4s_b33n_Ident1f3d}]

Key Takeaways / Remediation

Email Privacy

Sharing contact email addresses on public or shared community servers opens vector routes for enumeration and targeted OSINT attacks.

Aggregator Risk

Services like Gravatar expose profile bios, connected websites, and email linkages by design. Audit linked accounts regularly.

💭 Final Thoughts

Often, the hardest part of an OSINT challenge is not locating a profile, but recognizing the connection between a simple hint ("free tool starting with G") and the target's email identifier. Simple, quick, and rewarding!

Overheard at Breakfast — OSINT Walkthrough