The Disappearance

Welcome to The Disappearance, an OSINT room developed by me! This room is the first part of a two-part series revolving around the mysterious case of Michael Brown, a software developer from Toronto who has recently gone missing. Your mission is to uncover details about Michael.

Link to the room:https://tryhackme.com/r/room/thedisappearancepart1

Challenge Level- Easy

Part 1: Finding Michael

This room focuses on conducting an in-depth investigation into Michael's digital footprint to gather key details about his life.

⚠️ Spoilers Ahead! ⚠️

Need Help? Read this Beginner Guide

If this is your first time doing an OSINT(Open Source Intelligence) room, Don't worry! This room is designed with beginners in mind.

What is OSINT?

OSINT is about gathering publically available information to solve problems or uncover mysteries. (Example finding missing people)

It can involve things like decoding hidden messages, analyzing social media profiles, or tracking down locations using photos.

Tools You'll Be Using

  1. Inspect Element (F12 on your keyboard or right-click on anywhere on a webpage)
  2. Reverse Image Search: Google Images, Yandex Image Search or TinEye
  3. CyberChef: A tool that helps with decoding, encoding and manipulating data.

Tips for Success

  • Read Carefully: Many clues can be hidden, so it's important to pay attention.
  • Take Notes: Keeping a note of what you have cracked so far will help keep you on the right track and help link the clues.
  • Ask for help: Google or The TryHackMe Discord will be helpful.

You'll gain hands-on experience with beginner-friendly OSINT techniques.

Ready to start? Let’s solve the mystery of Michael Brown together!

Tasks Overview

Task 1: Introduction

To get started, type "I'm in" in the answer bar. Let the investigation begin.

Task 2: Background Research

Michael’s family has shared a link to a personal blog he maintained. While the blog appears like any other, it holds key information to help you uncover more about him.

Step 1: Exploring the Blog

Opening the blog reveals some initial details about Michael, but not all the answers are visible. You’ll need to dig deeper:

  • Use Inspect Element (F12) to find a hidden Base64-encoded string in the blog's HTML.
  • Decode the string using CyberChef to reveal valuable information.

The blog also hints at Michael's Instagram account, which will be the next major clue in this investigation.

Step 2: Analyzing Michael’s Instagram

Michael's Instagram account contains posts, captions, and a bio link that can reveal more details about him:

  1. Reverse Image Search:
    • One of his posts features a photo of a pool with the caption: “Late night swim before sleeping is amazing.”
    • Take a screenshot of the pool photo and perform a reverse image search to uncover details such as his address, location, and the location phone number.
  2. Follow the Instagram Bio Link:
    • Michael’s bio contains a link to his LinkedIn profile.

Step 3: Exploring Michael’s LinkedIn

Michael’s LinkedIn page provides deeper insights into his life and career, including:

  • Where he graduated from.
  • His current job and workplace.
  • Confirmation of his location.

Each clue you uncover helps you build a comprehensive picture of Michael and the events leading up to his disappearance.

Conclusion

By investigating Michael’s blog, Instagram, and LinkedIn, you’ve pieced together important details about his life. These discoveries will serve as the foundation for Part 2, where the mystery takes an even darker turn.

Feedback

This is my first TryHackMe room, and I’d love to hear your feedback! Let me know how I can improve or make the experience more engaging for OSINT enthusiasts.

Good luck, and happy hunting!

The Disappearance: Part 1 Write-Up