Ananya's Shadow

OSINT, Hard, 900 pts

Hack!tUp{sh4d0w_n0d3_unv31l3d_99}

The challenge links a blog (webapp-ten-fawn.vercel.app, "Shadow Notes") by av_shadow01. Its Instagram, Twitter and GitHub pages are all mock pages inside the same app, so the real GitHub has nothing (github.com/av_shadow_dev is a 404).

What the pages give:

• Instagram bio: R2l0SHViOiBhdl9zaGFkb3dfZGV2 is Base64 for GitHub: av_shadow_dev.
• Cafe photo EXIF: ImageDescription: passphrase: Cyber_Shadow_01.
• Twitter: a decoy flag{ananya_is_not_here}.
• GitHub, deleted commit "Remove hardcoded config": the diff in scripts/db_sync.py shows PORTAL_KEY = "S3aTtl3_C0ff3e_L0v3r_99".
• blog_header.png: an RGB-LSB message that repeats the pointer to the deleted commit. The PGP key at /public_key.asc has nothing hidden.

The README says the important files were moved "offline and into the shadows". None of the visible pages link to anything, so I guessed paths on the blog. /cache.zip returns a 477-byte WinZip AES-256 archive with two files.

The EXIF passphrase doesn't open it. The leaked portal key does:

7z x -p'S3aTtl3_C0ff3e_L0v3r_99' cache.zip

read_me.txt holds a second decoy (flag{y0u_m1ss3d_th3_r34l_0n3}). secrets.txt holds the real flag.