# Overheard at Breakfast: OSINT - image x Gmail x Gravatar profile & Base64  (TryHackMe)

Link to the CTF challenge on TryHackMe: [Overheard at Breakfast](https://tryhackme.com/room/hh-overheardatbreakfast-6f01793c)

> **Concierge Briefing**
> 
> The breakfast terrace is loud this morning, clinking cutlery, espresso machines, the usual chatter. One guest couldn't help but linger at a nearby table, seeing more of a conversation than they were meant to.
> 
> When the table's occupant stepped away for a refill, they seized the moment and grabbed a screenshot before it could disappear. Somewhere in that conversation is enough to track down an account nobody was supposed to find.
> 
> **TODAY'S ITINERARY**
> 
> *   \[ \] Analyze the provided conversation for identifying details
>     
> *   \[ \] Extract the relevant clues
>     
> *   \[ \] Locate the hidden account
>     
> *   \[ \] Submit the flag
>     
> *   **OSINT**
>     
> *   **Social Media**
>     
> *   **Hashing**
>     

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/ac7b4e3b-a54f-43e8-bd7d-81f60aaa4c1b.png align="center")

*   The above image was attached to the challenge. This is an OSINT challenge; we're supposed to use the screenshot to help us find any information that can lead us to the flags. From the screenshot, we can see the email and a little information about Lambo, their avatar (people tend to reuse one on different platforms), and the fact that they're visiting the resort.
    
*   From a previous OSINT challenge, I learned about this platform called [epieos](https://epieos.com/), where you can search emails and find some OSINT information
    

> ### checked [epieos](https://epieos.com/)
> 
> `lambobytelotushotel@gmail.com` **2 results(7.8 seconds)Mon, 03 Aug 2026 12:40:35 GMT**
> 
> !Epieos logo
> 
> Google account finder will show you if the requested email is linked to a Google account and/or if the person left reviews on Google Maps.
> 
> lambobytelotushotel@gmail.com
> 
> img/profile/fake/vonneumann.jpg
> 
> Sign up
> 
> 109541557676124188877
> 
> 1777-04-30
> 
> Sign up
> 
> https://www.google.com/maps/contrib/109541557676124188877
> 
> https://calendar.google.com/calendar/u/0/embed?src=lambobytelotushotel@gmail.comCopy URL
> 
> `https://web.archive.org/web//plus.google.com/109541557676124188877`Copy URL

*   This tool allows you to find a gravatar account linked to an email address.
    

> [lambobytelotushotel@gmail.com](mailto:lambobytelotushotel@gmail.com)
> 
> img/profile/fake/euler.jpg
> 
> Sign up
> 
> 314159265359
> 
> Sign up
> 
> https://example.com/longhiddenlink
> 
> Sign up
> 
> Edsger Wybe Dijkstra
> 
> Sign up
> 
> Carl Friedrich Gauss
> 
> Sign up
> 
> Leonhard Euler
> 
> Sign up
> 
> Transia
> 
> Sign up

```markdown
echo -n "lambobytelotushotel@gmail.com" | md5sum
d4a5fc5d3128890778667e24617d7cc0  -

curl -s https://api.gravatar.com/3/profiles/d4a5fc5d3128890778667e24617d7cc0
{
    "errors": {
        "error": "Unsupported version"
    }
}%                                                                                                                                                                                                      

curl -s https://www.gravatar.com/d4a5fc5d3128890778667e24617d7cc0.json

curl -s -o /dev/null -w "%{http_code}\n" "https://www.gravatar.com/avatar/d4a5fc5d3128890778667e24617d7cc0?d=404"
200

```

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/c82a075e-c129-4bdb-827c-e0bb9b39d4b9.png align="center")

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/4e434e8f-a88b-443f-8d71-7281848ffc03.png align="center")

![](https://cdn.hashnode.com/uploads/covers/5f4a98085ee1ba597542e097/0ae13d4b-c20a-473d-a030-7394635568f8.png align="center")

### Conclusion

Overheard at Breakfast is a clean example of **OSINT correlation through identifier reuse**: no exploitation, no injection, just patient pivoting from one leaked data point (a screenshot) through multiple public services that all key off the same underlying identifier: the email address.

#### What the investigation demonstrates

1.  **A single email address is a surprisingly strong pivot point across unrelated services.** Once [`lambobytelotushotel@gmail.com`](mailto:lambobytelotushotel@gmail.com) was visible in the screenshot, it became the key that unlocked multiple independent OSINT surfaces:
    
    *   **Epieos → Google account correlation**: confirmed the email is tied to an active Google account (numeric Google ID `109541557676124188877`), exposed a Google Maps contributor profile, and even surfaced a Wayback Machine snapshot of a defunct Google+ profile - showing that *deleted* platforms can still leak identifying data years later via archives.
        
    *   **Gravatar lookup**: the same email, MD5-hashed, resolves to an avatar image - Gravatar's whole design assumes the hash of your email is a safe, non-reversible identifier to expose publicly, which OSINT tooling routinely disproves in practice.
        
2.  **Gravatar's hash-as-identifier model is a privacy weak point, not a security control.** MD5 of a known/guessed email is instant to compute (`echo -n "..." | md5sum`), and Gravatar's own API confirms whether that hash has a registered account (`200 OK` on `/avatar/<hash>?d=404` means "this hash has a real avatar," not the default fallback). This turns "does this email have a Gravatar" into a simple oracle - useful for OSINT, but also a reminder that MD5-of-email is not obfuscation; it's a lookup key anyone can compute offline.
    
3.  **API versioning matters when chaining tools.** The `api.gravatar.com/3/profiles/<hash>` call returned `"Unsupported version"` - a good practical lesson that public OSINT APIs change their versioned endpoints over time, and a failed call doesn't necessarily mean the target has no data; it can mean the wrong API version/endpoint was hit. The correct next step is checking Gravatar's current documented endpoint (their v1/v3 profile API has shifted) rather than concluding the lookup dead-ends there.
    
4.  **Avatar reuse is a durable correlation signal.** The briefing's own hint "people tend to reuse one avatar across platforms" is exactly how a defender or investigator pivots from "an email in a screenshot" to "this person's accounts elsewhere," and it's equally exactly how an attacker doing reconnaissance on a real target would work. Reverse image search on a distinctive avatar (TinEye, Google Lens, PimEyes-class tools) is normally the next move here, in addition to hash-based lookups.
    

#### Security takeaways

*   **Screenshots leak more than intended.** The entire chain started from someone glimpsing a screen over someone's shoulder ("shoulder surfing") and capturing an email address: a reminder that visible-on-screen data in public spaces (cafes, terraces, shared workspaces, video calls) is a real reconnaissance vector, not a theoretical one.
    
*   **Email addresses should be treated as quasi-PII even when "just an email."** A single address, once known, chains into: real name (via Google account/Maps reviews), Gravatar-hosted avatar and possibly bio/social links, and historical presence on now-defunct platforms via web archives. Anyone provisioning accounts (guest wifi portals, hotel apps, loyalty programs) should assume the email itself is enough to start building a profile of the person.
    
*   **Deleted ≠ gone.** The Wayback Machine snapshot of a defunct Google+ profile is the clearest example: platform shutdown doesn't remove archived exposure. Any takedown/deletion request only addresses the live platform, not third-party archives.
    
*   **MD5(email) is not a privacy-preserving identifier.** Any system using a hash of a well-known, guessable, or breach-leaked field (email, username) as a "safe" public key is exposed to exactly this kind of dictionary/rainbow lookup. This applies to Gravatar by design, but the same anti-pattern shows up in other systems that hash predictable inputs and assume that's sufficient obfuscation.
    

#### Loosely mapped to attacker tradecraft (MITRE ATT&CK / PRE-ATT&CK framing, since this simulates recon against a target)

*   **T1589.002: Gather Victim Identity Information: Email Addresses**; the entire chain starts here.
    
*   **T1593.001: Search Open Websites/Domains: Social Media,** Google Maps contributor profile, Google+ archive.
    
*   **T1596.002: Search Open Technical Databases: WHOIS/Reverse lookups** (adjacent), Epieos and Gravatar function as reverse-identifier lookup services in the same spirit.
    

#### For your OSINT methodology notes

Worth keeping as a repeatable pivot sequence for any email-first OSINT task:

1.  Epieos (or similar) → check Google account linkage, Maps reviews, calendar exposure.
    
2.  Gravatar hash lookup (MD5 of lowercased, trimmed email) → check for avatar/profile existence via the *current* API version.
    
3.  Wayback Machine on any historical profile URLs surfaced above.
    
4.  Reverse image search on any recovered avatar to find reused instances elsewhere.