Description #
Invincible is an easy-level OSINT challenge from CyberTalents designed to test how well you can trace digital footprints and recover hidden information.
The challenge is simple:
Our threat intelligence team has noticed suspicious activity from a user named “soremanzo.”
Your task? Find out what he’s hiding.
This challenge is a great warm-up for anyone new to open-source intelligence because it covers two fundamentals:
- Username enumeration — tracking one username across many platforms under the same username.
- Web archives — retrieving previously deleted or hidden information
Setting up My Workspace #
Before diving in, I like keeping my environment clean. I opened up my terminal and created a Python virtual environment for any tool I’d need to install:
python3 -m venv sherlock-env
source sherlock-env/bin/activate
This step saves you from dependency errors later (Kali users know this pain well).
Next, I installed Sherlock, one of the most popular username search tools for OSINT:
git clone https://github.com/sherlock-project/sherlock.git
cd sherlock
pip install.
Sherlock uses the usernames you provide to check their presence across hundreds of websites.
To make running it easier, I created a simple executable script:
echo 'python3 -m sherlock_project.sherlock "$@"' > sherlock
chmod +x sherlock
Now I could just run:
./sherlock soremanzo --timeout 10
Hunting “Soremanzo” #
Sherlock scanned multiple platforms and returned around five profiles under the username soremanzo. I went through each manually, because relying on just one result can make you miss something crucial.
Most profiles were inactive or generic placeholders, but the Disqus profile caught my attention. Disqus is often used for blog comments, and people tend to leave little traces behind there.
A Clue in Plain Sight #
On the Disqus profile’s “About” section, there was a short message that read:
“Oh how you find me, Never mind I knew that you will find me anyway so I deleted your flag :D Not all what you need will be on your way back.”
[Insert Disqus profile screenshot here]
The last sentence, “Not all what you need will be on your way back"…WayBack Machine? The Wayback Machine (the Internet Archive) is is a digital archive that stores historical snapshots of websites over time, allowing you to access pages even after they’ve been edited or deleted. So if the flag was deleted, maybe it still existed in an older snapshot.
Let’s Go Back in Time. #
I headed to web.archive.org and pasted the Disqus profile URL: https://disqus.com/by/soremanzo/
The graphical interface (GUI) showed only 7 captures, but I’d read that the Wayback Machine sometimes hides additional snapshots.
To dig deeper, I used the CDX API with curl, which lists all saved snapshots, even the ones not visible through the web interface.
curl -s "https://web.archive.org/cdx/search/cdx?url=https://disqus.com/by/soremanzo/&output=json"
This command returned multiple timestamps.
I browsed through them and picked the one from May 20, 2024: https://web.archive.org/web/20240520104532/https://disqus.com/by/soremanzo/
Opening that URL took me to an archived version of the profile, and there it was! The missing flag!
The Flag #
FLAG{4rch1v3_Usu4LLy_C0nt41n_Us3fuL_1nf0rm4t10n}