# OSINT CTF walkthrough: reset a password with a security question

Published: 2026-11-07 · Updated: 2026-11-03 · By HackerGPT Team
Canonical: https://hackergpt.org/blog/osint-ctf-security-question-reset/

> How an OSINT CTF challenge resets an account by answering its security question from public clues — the alias-pivoting method, how the walkthrough reasoned through it, and why security questions are weak for your own accounts.

**TL;DR:** This OSINT CTF resets an account without touching the password at all. You read the account's security question off the reset form, then recover its honest answer from clues the owner left in public — a writing habit, a reused alias, an archived post — and type that answer in. The lesson for your own logins: a security question whose answer is discoverable online is not a second factor, it is a slower password. Practise the method only on a legal target such as [CyberGym](https://cybergym.hackergpt.app).

This is for learners and CTF players who want to understand how an OSINT challenge turns scattered public facts into an account takeover, and for anyone who still relies on security questions. You will see the pivoting method behind the "Reset Uvogin's Password" challenge on CyberGym, how the manual walkthrough in the video worked through it, how HackerGPT's CTF Mode solved it afterwards, and what to change about your own recovery settings. Everything here stays on CyberGym, a legal practice target — test security questions only on accounts you own or are permitted to test.

[Watch on YouTube: CyberGym Challenge: Reset Uvogin's Password](https://www.youtube.com/watch?v=yOXncuwokRw)

CyberGym is a hosted [OWASP Juice Shop](https://owasp.org/www-project-juice-shop/) instance ("Reset Uvogin's Password" is a four-star *Sensitive Data Exposure* challenge in the [OWASP Juice Shop companion guide](https://pwning.owasp-juice.shop/companion-guide/latest/part2/sensitive-data-exposure.html)), and the people in it — Uvogin, Emma, MC SafeSearch — are fictional personas the project created for exactly this exercise (Uvogin borrows his name from an anime character, which is why a plain web search for it turns up anime results first). That is what makes it safe to narrate: no real person's footprint is being searched.

## What is an OSINT security-question attack?

It is recovering an account's password-reset answer from open sources instead of guessing or cracking it. Open-source intelligence (OSINT) means working only from information anyone can lawfully read: public posts, profiles, archives and the application itself. When an application lets you reset a password by answering a question like "Your favorite movie?", the security of the whole account rests on whether that answer is private — and favourite films, pets, schools and hometowns usually are not.

That is why the [OWASP Choosing and Using Security Questions Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Choosing_and_Using_Security_Questions_Cheat_Sheet.html) opens with a blunt warning: "Security questions are no longer recognized as an acceptable authentication factor per NIST SP 800-63." The reset path is meant to be no weaker than normal login, and a guessable answer makes it weaker. This challenge is a controlled demonstration of that gap.

## How do I find which security question an account uses?

Ask the application — the reset form will tell you, because Juice Shop exposes the question on an endpoint that needs no login. On CyberGym the account's email follows the shop's own pattern (`<name>@juice-sh.op`), which you can confirm from any product review, and the security question comes straight back:

```bash
curl -s "https://cybergym.hackergpt.app/rest/user/security-question?email=uvogin@juice-sh.op"
```

```json
{"question":{"id":12,"question":"Your favorite movie?","createdAt":"2026-10-29T17:43:06.540Z","updatedAt":"2026-10-29T17:43:06.540Z"}}
```

Now the target is defined: not "break in", but "find out this user's favourite movie." That reframing is the whole challenge. (This same endpoint is also a textbook *user enumeration* weakness — it answers differently for accounts that exist — but here we only need the question text.)

In the video the walkthrough gets there through the browser instead: the Forgot Password form was already pre-filled with an address from an earlier challenge, so it swapped the name in that address for `uvogin`, and the form showed the question. The `curl` call above is just the fastest way to read it and to confirm you have the right account before spending time on the search.

## How does the OSINT pivot actually work?

You chain small, public facts, where each one tells you where to look next. The move that matters is pivoting on how a person writes, not just on their name. The diagram below traces the full method as the [companion guide's solution](https://pwning.owasp-juice.shop/companion-guide/latest/appendix/solutions.html) lays it out; the walkthrough in the video took a shorter route through the same chain, described after it.

![Eight-step pivot chain from a username to a security answer, with the current profile shown as a dead end](https://hackergpt.org/blog/osint-ctf-security-question-reset/pivot-chain.webp) *The pivot chain for this challenge. Each box produces the clue the next one needs; the dashed grey box is a dead end that still narrowed the search.*

The first useful clue is on CyberGym itself. This user's product reviews are written in a consistent leetspeak style, which you can read straight from the reviews API:

```bash
curl -s "https://cybergym.hackergpt.app/rest/products/2/reviews"
```

```json
{"status":"success","data":[{"message":"y0ur f1r3wall needs m0r3 musc13","author":"uvogin@juice-sh.op","product":2,"likesCount":0,"likedBy":[],"_id":"v3usFxrJddtxRJp8D","liked":true}]}
```

He leaves reviews in the same style on other products too. That habit — letters swapped for digits — is the pivot. The companion guide points at [Sherlock](https://github.com/sherlock-project/sherlock), a tool that checks a username across many sites at once; the guide notes that the plain alias finds nothing, and that trying leet variations of it leads to the right account. This is the general OSINT lesson: **people reuse the same handle and the same stylistic tics across platforms**, so a distinctive writing habit is itself a selector you can search on.

The walkthrough in the video skips the reviews and Sherlock. It searches the web for the name plus "social media", lands on a social profile whose handle swaps the *o* for a zero, and only then notices the same letters-for-digits style in the posts. That confirms it has the right persona, which is the same pivot approached from the other side. The video then opens an archived snapshot of that profile. Because those are third-party surfaces, we stop reproducing the lookups here and describe only the shape of the method: the live profile confirms the persona but not the answer, and an older, since-deleted post — recovered from a web archive — names the favourite film. Two general techniques are worth taking away:

- **Deleted is not gone.** Public web archives keep snapshots of pages long after the original removes a post. "I deleted it" is not the same as "no one can read it."
- **Old content is less guarded.** People curate their current profile and forget what they wrote years ago. The oldest posts are often where the honest answer sits.

For the method at full size — turning one seed like a domain or a handle into a map of someone's public exposure — see [intelligence gathering](https://hackergpt.org/blog/intelligence-gathering/) and [accelerating OSINT workflows](https://hackergpt.org/blog/accelerating-osint-workflows-ai-driven-intelligence-gathering-with-hackergpt/).

## Completing the reset on CyberGym

With the answer in hand, the reset is the easy part — and the part you can run yourself. Juice Shop's Forgot Password form takes the email, the security answer and a new password; submit it and the form reports "Your password was successfully changed." The verification step is the one not to skip:

```bash
# After resetting via the Forgot Password form, confirm the new password works:
curl -s -X POST "https://cybergym.hackergpt.app/rest/user/login" \
  -H "Content-Type: application/json" \
  -d '{"email":"uvogin@juice-sh.op","password":"<the-new-password-you-set>"}'
```

A `200` with an authentication token means the reset took and the account is now yours; a `401` means the answer or the new password was wrong. The walkthrough in the video does the same: it resets, then logs in with the new password to prove the reset worked, and changes the profile picture to show it has the account. That is good practice in any security lab: a change you cannot verify is a change you cannot trust. ## How HackerGPT's CTF Mode solved it

After the walkthrough ends, the last part of the video (from about 14:15 to the end, without narration) gives HackerGPT the same challenge in CTF Mode: the challenge text, the Forgot Password link and the three hints, pasted into one prompt. What the screen shows it doing:

- **Web search first.** It searches for Uvogin and his favourite movie, then opens the Forgot Password page in its browser panel.
- **The question from the API.** Its notes record a `GET /rest/user/security-question` for `uvogin@juice-sh.op`, returning "Your favorite movie?" (question id 12) — the same call as the `curl` above.
- **The persona, then a cross-reference.** It finds the leetspeak handle on X (zero instead of *o*), confirms the writing style from a post, and finds a film-diary profile under the same alias that lists favourite films.
- **The answer from public write-ups.** It confirms the answer with a web search for existing solutions to the challenge. It does not open a web archive the way the walkthrough does.
- **Reset and verify.** It fills the form with JavaScript, gets "Your password was successfully changed.", then logs in as Uvogin with the new password and lands on the shop's search page.

The run ends with a solved summary, the attack flow, and a remediation list: avoid guessable questions, use multi-factor authentication, rate-limit reset attempts, and use email reset links, OTPs or push notifications instead of knowledge-based authentication. One thing to read honestly here is the cross-check against published write-ups. That is fine on a public practice challenge, but your own application has no write-ups. The method that carries over is the one the walkthrough shows: question, alias, writing habit, archive.

If you want the fuller "read the app, then act" loop this sits inside, [CTF for beginners: start with web challenges](https://hackergpt.org/blog/ctf-for-beginners-web-challenges/) walks it step by step, and HackerGPT's own [CTF Mode](https://hackergpt.org/features/ctf-mode/) is built to run it on a target you own.

## What this means for your own accounts

The attacker never needed the password, so a strong password would not have helped. Everything that mattered was in the recovery path. To close the same gap on your own logins:

- **Treat security-question answers as passwords, not facts.** If a site forces a security question, do not answer it truthfully. Store a long random string as the "answer" in your password manager. An honest answer is public; a random one has nothing to find.
- **Prefer real second factors.** [NIST SP 800-63B](https://pages.nist.gov/800-63-4/sp800-63b.html) does not list security questions among its authenticator types, and its account-recovery options are repeated identity proofing, a prearranged recovery contact or recovery codes. Security questions are not one of them. It also says verifiers "SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., 'What was the name of your first pet?') or security questions when choosing passwords." Use an authenticator app, a passkey or a hardware key where the site offers one.
- **Audit what you have already posted.** Assume old posts, archived snapshots and reused handles are all readable. The point of practising this method on a legal target is to learn to look at your own footprint the same way an attacker would — not to look at anyone else's.

None of this makes an account impossible to attack; it removes the specific, cheap path this challenge used. Findings like these show what one weak recovery option exposes, not that an account is secure once you fix it.

## Key takeaways

- A security question is only as strong as the privacy of its answer; favourite films, pets and schools are usually public.
- The reset form hands you the question for free, so an OSINT challenge is really a search problem: find one specific private-seeming fact.
- Pivot on writing style and reused aliases, not just names — a distinctive habit is a selector you can search across sites.
- Deleted and archived content keeps answering long after the author moves on; old posts are the least guarded.
- On your own accounts, store random strings as security answers and switch to a real second factor; practise the attack only on legal targets.

## FAQ

### Is it legal to do OSINT for a CTF like this?

Yes, when it stays within the challenge. CyberGym is HackerGPT's hosted copy of OWASP Juice Shop, a deliberately vulnerable application built for practice, and its characters are fictional, so searching their invented personas harms no one. Running the same techniques against a real person's accounts without permission is a different matter and can be illegal; keep the practice on legal targets and turn the method on your own footprint, not other people's.

### Why are security questions considered weak?

Because their answers are often discoverable or guessable, and because a recovery path should be no weaker than normal authentication. OWASP's [Forgot Password Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html) says they "should not be used as the sole mechanism for resetting passwords," and OWASP notes they are no longer recognised as an acceptable authentication factor under NIST SP 800-63. A favourite-movie answer that an attacker can find online offers no real protection.

### How was the challenge solved in the video?

The walkthrough read the security question off the reset form, searched the web for the name and found a social profile under a leetspeak variant of it, confirmed the persona from the same letters-for-digits style in its posts, then checked an archived version of the profile to recover a since-deleted post that named the answer. It reset the password and logged in to verify. The video then shows HackerGPT's CTF Mode solving the same challenge: it found the same alias, cross-checked a film-diary profile and published write-ups, and then reset the password and logged in. The value is the reasoning chain, not the specific answer.

### What should I use instead of security questions?

Where a site lets you, use an authenticator app (TOTP), a passkey, or a hardware security key, and keep verified recovery contacts. If a security question is unavoidable, treat its answer as a second password: generate a random value and store it in a password manager rather than answering truthfully.

### Can deleted social media posts really be recovered?

Often, yes. Public web archives capture snapshots of pages over time, so a post that was later deleted can still be readable in an older snapshot. For account security this means your past posts remain part of your exposure even after you remove them, which is why auditing old content matters.

## Sources

- [OWASP Juice Shop companion guide — Sensitive Data Exposure](https://pwning.owasp-juice.shop/companion-guide/latest/part2/sensitive-data-exposure.html)
- [OWASP Juice Shop companion guide — Challenge solutions](https://pwning.owasp-juice.shop/companion-guide/latest/appendix/solutions.html)
- [OWASP Juice Shop project](https://owasp.org/www-project-juice-shop/)
- [NIST SP 800-63B — Digital Identity Guidelines, Authentication](https://pages.nist.gov/800-63-4/sp800-63b.html)
- [OWASP Choosing and Using Security Questions Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Choosing_and_Using_Security_Questions_Cheat_Sheet.html)
- [OWASP Forgot Password Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html)
- [Sherlock — username search across social networks](https://github.com/sherlock-project/sherlock)

Practise the method on [CyberGym](https://cybergym.hackergpt.app), then turn it on your own accounts — or point [HackerGPT](https://hackergpt.app) at a target you own to learn as it works.