# Password OSINT CTF walkthrough: a password hinted at in a song

Published: 2026-11-12 · Updated: 2026-11-03 · By HackerGPT Team
Canonical: https://hackergpt.org/blog/password-osint-ctf-walkthrough/

> How an OSINT CTF recovers a password from public media with no injection and no bypass, how the walkthrough reasoned through it, and why a password built from a public fact plus a habit is already public.

**TL;DR:** In CyberGym's "Login MC SafeSearch" challenge you log in with a user's real password without any injection or bypass, because the user described it in public: a music video names the personal detail it is built on and the character swap applied to it. The OSINT method is to find the public media the hint points at, extract the base word and the rule, and test the variants. The lesson for your own accounts: a password built from a public fact plus a predictable tweak is already public — use random, unique passwords from a password manager.

This is for learners and CTF players who want to see that not every authentication challenge needs a technical exploit, and for anyone who builds passwords from things they love. You will see the method behind the challenge on [CyberGym](https://cybergym.hackergpt.app), how the walkthrough in the video worked through it, what our own requests against CyberGym returned, and what to change in your password habits. CyberGym is a legal, deliberately vulnerable practice target; test logins only on accounts you own or are permitted to test.

[Watch on YouTube: CyberGym Challenge: Login McSafeSearch](https://www.youtube.com/watch?v=i7VPBIn_4qI)

CyberGym runs [OWASP Juice Shop](https://owasp.org/www-project-juice-shop/). "Login MC SafeSearch" is a two-star *Sensitive Data Exposure* challenge tagged OSINT: "Log in with MC SafeSearch's original user credentials without applying SQL Injection or any other bypass" ([OWASP Juice Shop companion guide](https://pwning.owasp-juice.shop/companion-guide/latest/part2/sensitive-data-exposure.html)). MC SafeSearch is a fictional rapper character, and the song is media the Juice Shop project points to for this challenge.

## Can you solve an authentication CTF without an exploit?

Yes, and this challenge forbids exploits on purpose. The only accepted solution is the account's original password, so SQL injection or a token trick would not count. That turns the challenge into pure reconnaissance: what has this person said in public that narrows down their password?

It is a useful corrective for learners. Many people start CTFs expecting every login form to be an injection target; here the weakness is entirely human. The companion guide's hint for the challenge is a song title and a joke that, after watching the music video, "even ⭐⭐ is a slightly exaggerated difficulty rating" ([companion guide](https://pwning.owasp-juice.shop/companion-guide/latest/part2/sensitive-data-exposure.html)).

## How do I find a password hinted at in public media?

Follow the hint to the media, listen for anything that sounds like a password rule, and separate it into a **base word** and a **transform**. The walkthrough in the video went in this order:

1. **Read the hint.** It names the user as a rapper and gives a song title about protecting passwords.
2. **Find the media.** A web search for the song title brings up the 2014 music video the companion guide links.
3. **Extract the clues.** In the lyrics, the character explains how he remembers his password: a personal detail (his dog's name) with some vowels swapped for zeros.
4. **Find the account.** His email is visible as the author of his product reviews on CyberGym.
5. **Test the base word, then the variant.** The plain name fails; applying the swap the song describes succeeds.
6. **Verify.** Log in and check the profile, orders, wallet and saved addresses — the walkthrough even adds an address — to confirm access.

![Six-step flow turning a stage name and a song into account access: hint, public media, account, base word, transform, verified login](https://hackergpt.org/blog/password-osint-ctf-walkthrough/password-from-public-media.webp) *The chain for this challenge. Nothing in it is an exploit: every step reads something the account owner made public.*

Step 5 is the instructive one. The first guess — the plain detail exactly as heard — is wrong, which is typical: people rarely use the raw fact. They apply a habit, such as capitalising, appending a year, or swapping letters for look-alike digits. When the source tells you the habit, as the song does here, the search space collapses to a handful of candidates.

## What did our own requests to CyberGym show?

Two things the video does not dwell on. First, the account's security question has nothing to do with the clues:

```bash
curl -s "https://cybergym.hackergpt.app/rest/user/security-question?email=mc.safesearch@juice-sh.op"
```

```json
{"question":{"id":8,"question":"Last name of dentist when you were a teenager? (Do not include 'Dr.')","createdAt":"2026-10-29T17:43:06.540Z","updatedAt":"2026-10-29T17:43:06.540Z"}}
```

So the reset path is not the way in. The pet's name would not answer a dentist question; this challenge is about the password itself leaking, not the recovery flow — a different failure from the security-question challenges elsewhere on CyberGym.

Second, the login endpoint confirmed the base-word-plus-transform shape. We sent two login requests to `POST /rest/user/login` with the account's email: one with the pet's name exactly as the song says it, one with the swap applied. We are not printing the password itself; the status codes tell the story:

```text
password = base word as heard         -> HTTP 401  "Invalid email or password."
password = base word + described swap -> HTTP 200  {"authentication":{"token":"<redacted>","bid":8,"umail":"mc.safesearch@juice-sh.op"}}
```

The `401` for the plain word and the `200` for the variant are the whole lesson in two lines: the tweak added almost no protection once the habit was public. (On a shared practice instance, the challenge was already marked solved; the requests change nothing for other players.)

## How did HackerGPT solve it in the video?

From 09:07 the video shows HackerGPT working the same challenge in CTF Mode, without narration. The prompt is the challenge text, its two hints and the CyberGym URL, followed by "Use OSINT and figure out how to solve the challenge. Do not perform SQL Injection." On screen it requests `/ftp/`, a product search for "music" and the application configuration, while AppMap builds the state graph of the site. Its summary then reports the same chain as the manual run: the account's email exposed in product reviews, the lyrics of the song (found on a lyrics site) naming the dog and the vowel-to-zero swap, and a REST login that returned `200 OK` with a JWT. The CyberGym scoreboard shows "Login MC SafeSearch" as solved. Not every request it made was needed; the useful steps are the same base word and transform a person would find.

To see this read-first, act-second loop applied to whole applications, [CTF for beginners: start with web challenges](https://hackergpt.org/blog/ctf-for-beginners-web-challenges/) walks through it, and [where to practise hacking legally](https://hackergpt.org/blog/practice-hacking-legally/) covers why CyberGym is a safe place to try it. HackerGPT's [CTF Mode](https://hackergpt.org/features/ctf-mode/) solves CyberGym challenges like this one with each step explained, and the [CTF Mode field guide](https://hackergpt.org/docs/ctf/) shows a full run.

## How do I keep my own passwords out of public view?

Stop building passwords from facts about yourself. The challenge works because the password has a findable shape: a public detail plus a predictable rule. Remove the shape and there is nothing to find.

- **Use a password manager and random passwords.** A generated, unique password has no base word to discover. [NIST SP 800-63B](https://pages.nist.gov/800-63-4/sp800-63b.html) requires verifiers to allow password managers, recommends permitting paste, and notes that password managers "increase the likelihood that subscribers will choose stronger passwords".
- **Do not rely on character swaps.** Swapping letters for look-alike digits is a well-known habit, so cracking tools try it routinely. NIST tells verifiers to check new passwords against blocklists of "commonly used, expected, or compromised" values, including context-specific words such as the username ([NIST SP 800-63B](https://pages.nist.gov/800-63-4/sp800-63b.html)).
- **Never describe how you make passwords.** Not in a post, a talk, a video or a joke. A rule is as revealing as the password once someone knows the base word.
- **Turn on a second factor.** If a password does leak, an authenticator app, passkey or hardware key stops the login from being enough on its own.

For site owners the mirror image applies: enforce a blocklist, allow long passphrases and password managers, and offer a second factor. None of this makes an account impossible to break into; it removes the cheap path this challenge used.

## Key takeaways

- An authentication challenge that bans exploits is a reconnaissance problem: find what the user said in public.
- Split a public hint into a base word and a transform; the plain word usually fails and the habit-shaped variant succeeds.
- A password made from a personal fact plus a simple tweak is already public once either is known.
- Use random, unique passwords from a password manager and a second factor, and never share how you build passwords.
- Check what else an account exposes, such as its security question, but follow the clue the challenge actually points at.

## FAQ

### What is a password OSINT challenge?

It is a CTF task where you recover a user's password from public information rather than by exploiting the application. In CyberGym's "Login MC SafeSearch", the only accepted solution is the original password, worked out from a song the character published. It teaches that weak password habits can be as damaging as a software bug.

### Why does replacing letters with numbers not make a password strong?

Because the substitution is predictable and widely known, so password-cracking tools and attackers try it automatically. It also keeps the base word recognisable. A long random password from a password manager offers far more protection than a familiar word with a few digits swapped in.

### Is it legal to log in to accounts on CyberGym?

Yes. CyberGym is an OWASP Juice Shop instance published as a legal practice target, and its accounts belong to fictional characters. Logging in to real accounts that are not yours, even with a correctly guessed password, is unauthorised access and can be illegal.

### How was the challenge solved in the video?

The walkthrough followed the hint to the music video, extracted the dog's name and the vowel-to-zero habit from the lyrics, found the account's email in its product reviews, tried the plain name (rejected) and then the variant (accepted), and confirmed access in the profile. No injection or bypass was used. The video then ends with HackerGPT solving the same challenge in CTF Mode from the song lyrics, as described above.

## Sources

- [OWASP Juice Shop companion guide — Sensitive Data Exposure](https://pwning.owasp-juice.shop/companion-guide/latest/part2/sensitive-data-exposure.html)
- [OWASP Juice Shop project](https://owasp.org/www-project-juice-shop/)
- [NIST SP 800-63B — Digital Identity Guidelines, Authentication](https://pages.nist.gov/800-63-4/sp800-63b.html)

Practise on [CyberGym](https://cybergym.hackergpt.app), and point [HackerGPT](https://hackergpt.app) at a site you own to learn as it works.