GitHub Email OSINT

Platform: hackerlab | Category: OSINT | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-06 | Status: Solved Techniques: gravatar_hash_reversal, git_commit_forensics, mask_attack

Summary

The task provided a URL to a GitHub profile with an unusual username: https://github.com/9497f168dc8e17cfd0e8ff622308f08d/

GitHub Email OSINT — HackerLab

Description

The task provided a URL to a GitHub profile with an unusual username: https://github.com/9497f168dc8e17cfd0e8ff622308f08d/

Goal — find the email of the account owner.

Analysis

1. GitHub Profile Investigation

Visiting the profile, I found:

• Username: 9497f168dc8e17cfd0e8ff622308f08d (looks like an MD5 hash)
• README.md with a hint: "my original nickname contains 8 lowercase letters and then number 432"
• Avatar loaded via Gravatar: https://s.gravatar.com/avatar/0f6989e3f07364b38a89b96b6c856950?s=256 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

2. Gravatar Hash

Gravatar uses MD5 hash of the email (lowercase) to identify the avatar:

Gravatar URL: https://s.gravatar.com/avatar/{MD5(email.lower())}

Extracted hash: 0f6989e3f07364b38a89b96b6c856950

Querying the Gravatar API, I found the profile username: cocaxo9932 (not the target email).

3. Git History Forensics (Key Finding)

Examining the commit history via GitHub API, I discovered that the first commit contained a line that was later deleted:

"I'm currently working on gmail.com email box" ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This revealed the email domain: @gmail.com

Solution

Collected hints:

1. Email consists of 8 lowercase letters + "432" + "@gmail.com"
2. MD5(email) = 0f6989e3f07364b38a89b96b6c856950
3. Format: ????????REDACTED where ? — lowercase letter

Hashcat Mask Attack

 bash read-only • copy allowed Copy
# Save the hash
echo "0f6989e3f07364b38a89b96b6c856950" > gravatar_hash.txt

# Run hashcat with mask
hashcat -m 0 -a 3 gravatar_hash.txt '?l?l?l?l?l?l?l?lREDACTED' -O

Parameters:

• -m 0 — MD5 mode
• -a 3 — mask attack
• ?l — any lowercase letter (a-z)
• -O — optimized kernels ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Result: Cracked in ~1 second!

0f6989e3f07364b38a89b96b6c856950:REDACTED

Verification

 python read-only • copy allowed Copy
import hashlib

email = "REDACTED"
md5_hash = hashlib.md5(email.encode()).hexdigest()
print(md5_hash)  # 0f6989e3f07364b38a89b96b6c856950 ✓

• The word "ghubanon" — exactly 8 lowercase letters
• MD5 hash matches the Gravatar hash

Useful Commands

 bash read-only • copy allowed Copy
# Get commit info via GitHub API
curl -s "https://api.github.com/repos/USER/REPO/commits" | jq

# View diff of specific commit
curl -s "https://api.github.com/repos/USER/REPO/commits/SHA" | jq '.files[].patch'
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Gravatar profile lookup
curl -s "https://www.gravatar.com/HASH.json" | jq

Lessons Learned

1. Git stores everything — deleted lines remain in commit history
2. Gravatar = MD5(email) — knowing the email format, you can bruteforce it
3. Hashcat is fast — 26^8 combinations (~208 billion) are cracked in seconds on GPU
4. README often contains hints — carefully read all files in the repository ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍