2020 OSINT Quiz Writeup 3/6 – Source & JSON

I continue with the 2020 OSINT quiz, this time doing questions for the Soruce & JSON category.

Intro

At the start of the year I decided to do a writeup of the OSINT quiz 2020. If you’d like to know more about the challenge or want to find the other parts of this writeup you can find links below.

Part 1

Part 2

 SPOILER WARNING - this article will go over everything, so if you're currently playing the quiz or interested in doing so I would advise that you don't continue reading. Sorry, but knowing the answers spoils all the fun.

Question 7


So, in question 7 we have been asked to find the exact timestamp of the first reddit post linking to https://osintcurio.us.

In order to find this, let's look at

Here's what we know:

·         We need to be looking on reddit

·         We're looking for a post (not a comment)

·         The post is from December 2018

·         The post will link to https://osintcurio.us

·         The timestamp will be in the source of that post.

The obvious starting place was to find the post in question. Usually to find a post on a website I would use that website's search function. However, Reddit has a reputation for having a pretty poor search feature, and even for non-OSINT use Google is often suggested as the best approach.


I wrote a google dork that I thought would show me pages that link to https://osintcurio.us. It didn't.

This however, lead me to a reddit feature showing all posts linking to the domain, which is not something I expected.


From here, I could see that the most recent post was the bottom one, submitted 2 years ago. This would roughly line up with the appropriate dates, as now to December 2018 would round down to 2 years.


So, I clicked on the link to see more. You can actually just hover over the part that says "2 years ago" and it'll tell you, but I'm going to do this the intended way anyway because it's more educational (and it'd probably be easier to copy the date stamp from the HTML).


I decided the quickest way of doing this would be to inspect the element of the "2 years ago" stamp, as it made sense for it to be there. Upon checking, it wasn't, which is great because I get to be even more educational.


I tried searching for 2018, +00:00 and a couple of other things, and nothing showed up, which I thought was really weird. There was a link to a page that would give us the date, but not the time.


Anyway, I went back to the domains page and it turned out that you can see the date there. It seemed weird to me that it would be on the list of posts, but not the post itsself. The biggest difference I could see is that the domains page is using the old reddit interface, and I was viewing the post in the new interface.


I checked the post in old reddit, and I could see the timestamp there, meaning I was pretty sure it was an caused by the new reddit interface. To view a page using the old reddit interface, you can just replace "reddit.com" in your address bar with "old.reddit.com" instead. I did double check if an extension I use, reddit enhancement suite, was somehow causing this to change but it's the same without it. I'm sure there's a way to get this timestamp somewhere in the source for the new interface, but I'd suggest you stick with the old interface as it definitely makes things easier!

Anyway, I handed this timestamp in, and moved onto the next question!

Question 8