TRAINING EXERCISE · Everything here is fictional — company, people, accounts and domains. Part of the Day One OSINT security-awareness CTF.
OSINT · security awareness

Day One

A new hire posted their onboarding welcome kit online. From that one photo, can you follow the trail of public leaks and log in to the company's onboarding portal as them?

Start: open the "Day 1" post →

Your goal

Log in to the Nexora Onboarding Portal as the new hire and read the flag.

You never need to brute-force anything. Everything you need is sitting in public somewhere across these fictional sites.

The fictional sites in scope

  1. Chirp — a social network (the starting post)
  2. nexora-dynamics.example — the company site & blog
  3. wiki.nexora.ctf — a public wiki
  4. Findr — a search engine that indexes only these pages
  5. Onboarding portal — where the flag lives

Rules of engagement

  1. Everything is self-hosted and fictional. Do not take any of this to real sites or people.
  2. No brute-forcing — the portal is rate-limited anyway.
  3. Think like an attacker reading someone's public footprint.

All names, companies, accounts and domains are invented for this exercise. Avatars and photos are illustrations — no real people are depicted.