Easy Phish

Platform: HackTheBox | Category: OSINT | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

Customers of secure-startup.com have been recieving some very convincing phishing emails, can you figure out why?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. For this challenge we may use several enumeration tools for OSINT.

2. I used dig for this challenge.

3. Run -> dig TXT secure-startup.com.

4. Notice there's a partition of the flag.

5. Next, run dig TXT secure-startup.com _dmarc.secure-startup.com.

6. Got another one, but this time has the }.

7. Concate all the partition.

REDACTED

1. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.