Overheard at Breakfast: the email that follows you via Gravatar — TryHackMe Hacker Holidays 2026, Day 6

[01] Recon: the chat that talks too much

The room attaches a .png: a Discord conversation between Lambo and Ponzi. No ports to scan, no shell to earn — here you just read. Lambo says he barely uses social media anymore, but that he still has an account on "a site where you link all your accounts together… and the name starts with a G". Further down, with the generosity of someone who fears no OSINT, he drops his email so he can be contacted: lambobytelotushotel@gmail.com.

[02] From email to profile: MD5 and Gravatar

The site "starting with G" is Gravatar: it ties a public profile (photo, bio, linked accounts) to an email address. The detail that makes it all mechanical is that Gravatar doesn't index the plaintext email, but its MD5 hash, computed after trimming whitespace and lowercasing. From there the profile URL is deterministic: no search needed, you build it by hand.

# normalizza l'email come fa Gravatar: trim spazi + lowercase, poi MD5
email="lambobytelotushotel@gmail.com"

# usa printf, NON echo: echo aggiunge un newline e ti cambia l'hash (efdfce...)
printf '%s' "$email" | tr 'A-Z' 'a-z' | tr -d ' \t\n\r' | md5sum
# -> d4a5fc5d3128890778667e24617d7cc0
# nota: questa email e' gia' minuscola e senza spazi, quindi qui trim+lowercase e' un no-op

# l'URL del profilo ora e' deterministico
https://gravatar.com/d4a5fc5d3128890778667e24617d7cc0

# normalize the email the way Gravatar does: trim whitespace + lowercase, then MD5
email="lambobytelotushotel@gmail.com"

# use printf, NOT echo: echo appends a newline and changes the hash (efdfce...)
printf '%s' "$email" | tr 'A-Z' 'a-z' | tr -d ' \t\n\r' | md5sum
# -> d4a5fc5d3128890778667e24617d7cc0
# note: this email is already lowercase and space-free, so here trim+lowercase is a no-op

# the profile URL is now deterministic
https://gravatar.com/d4a5fc5d3128890778667e24617d7cc0

Gravatar exposes no handy "search by email": the profile is reachable only because you reconstruct the hash. Which is exactly what makes it such a reliable OSINT channel — you compute the hash yourself, offline, in an instant.

[03] The .json endpoint and the aboutMe field

Here's the part that earns the writeup. The profile's HTML page is public, but Gravatar also exposes the same profile in several machine-readable formats: .json, .xml, .php, .vcf, .qr. The JSON object is the same profile you see on the page, just in machine-readable form: handy for extracting aboutMe in one shot without scrolling the HTML. That's where a base64 string was parked.

# opzione A - zero dipendenze: scarica il profilo grezzo e scorri a occhio "aboutMe"
curl -s https://gravatar.com/d4a5fc5d3128890778667e24617d7cc0.json

# opzione B - piu' pulito con jq (se manca: sudo apt install jq), estrai solo il campo
curl -s https://gravatar.com/d4a5fc5d3128890778667e24617d7cc0.json | jq -r '.entry[0].aboutMe'

# aboutMe (visibile anche sul profilo, qui lo prendo pulito)
# -> VEhN...base64_redatto...

# option A - zero dependencies: fetch the raw profile and eyeball "aboutMe"
curl -s https://gravatar.com/d4a5fc5d3128890778667e24617d7cc0.json

# option B - cleaner with jq (if missing: sudo apt install jq), pull just the field
curl -s https://gravatar.com/d4a5fc5d3128890778667e24617d7cc0.json | jq -r '.entry[0].aboutMe'

# aboutMe (also visible on the profile; here I grab it clean)
# -> VEhN...base64_redacted...

A method note, and at the same time why this room exists: the email MD5 is deterministic and permanent, so the profile stays addressable forever even if the visible bio were ever scrubbed. Cleaning the rendering doesn't rotate the identifier. That generalizes badly for the victim and nicely for the attacker: a list of emails becomes a bulk de-anonymization primitive across every Gravatar-backed site (WordPress, forums, etc.). Rule: never stop at the rendering — if there's an API, query it.

[04] Decode, flag and defense

The string in aboutMe smelled of base64: A–Z / a–z / 0–9 alphabet and, above all, the VEhN prefix — which in base64 is exactly THM, an instant confirmation you're on the right token (trailing = padding may or may not be present, depending on length). Into CyberChef with From Base64, or two seconds in a terminal, and there's the flag.

# From Base64 a mano (oppure CyberChef: ricetta "From Base64")
# incolla qui il token che hai estratto al punto [03] (al posto del placeholder)
echo 'VEhN...base64_redatto...' | base64 -d
# -> THM{████████████████████}

# runbook completo, dall'hash alla flag in una sola pipe — aboutMe è prosa + token base64 in coda, estraggo solo il token (serve jq)
curl -s https://gravatar.com/d4a5fc5d3128890778667e24617d7cc0.json \
  | jq -r '.entry[0].aboutMe' \
  | grep -oE '[A-Za-z0-9+/=]{20,}' \
  | base64 -d
# -> THM{████████████████████}

# From Base64 by hand (or CyberChef: "From Base64" recipe)
# paste the token you extracted in [03] here (replacing the placeholder)
echo 'VEhN...base64_redacted...' | base64 -d
# -> THM{████████████████████}

# full runbook, from hash to flag in a single pipe — aboutMe is prose + trailing base64 token, I extract just the token (needs jq)
curl -s https://gravatar.com/d4a5fc5d3128890778667e24617d7cc0.json \
  | jq -r '.entry[0].aboutMe' \
  | grep -oE '[A-Za-z0-9+/=]{20,}' \
  | base64 -d
# -> THM{████████████████████}

THM{████████████████████}