---
title: "HTB: Easy Phish [OSINT]"
url: "https://florea.xyz/htb-easy-phish/"
date: "2022-01-10T15:00:00+02:00"
updated: "2022-01-14T17:27:38+02:00"
author: "Bogdan Florea"
topic: "Hacking"
---

# HTB: Easy Phish [OSINT]

From the challenge text we can assume the following:\
\- it has something to do with secure-startup.com\
\- it must be an email thing.

First thing I do when email is involved is to look at the domain SPF records.\
So, let's fire a terminal and see what we go:

```shell
> dig secure-startup.com txt
> ;; ANSWER SECTION:
secure-startup.com.    0     IN    TXT     "v=spf1 a mx ?all - HTB{RIP_SPF_Always_2nd"
```

Aaand we got the first part of the flag: *HTB{RIP_SPF_Always_2nd*\
Next we check DKIM and DMARC. I'll skip the DKIM query as I got nothing relevant back from it, but the DMARC had the second part of the flag.

```shell
> dig _dmarc.secure-startup.com txt
> ;; ANSWER SECTION:
_dmarc.secure-startup.com. 0    IN      TXT     "v=DMARC1;p=none;_F1ddl3_2_DMARC}"
```

And there you go. The flag is **HTB{RIP_SPF_Always_2nd_F1ddl3_2_DMARC}**