Cache Me Outside

Room Link: Cache Me Outside

Introduction

This room is an OSINT challenge in which the goal is to identify a retired hacker by following clues scattered across the open internet. The investigation begins with a screenshot of a leaked conversation. From there, the task is to identify relevant details, search for connected online profiles and combine small pieces of publicly available information.

Challenge Objectives

The objective of this room is to answer the following questions:

• What is the retired hacker's full name?
• In which city is he located?
• Submit the name of the tram station where he got off on the 7th of May, 2026.
• What email address did he accidentally expose?
• What is his phone number?

Leaked Conversation Screenshot

My Approach

The first clue appeared in the provided screenshot of the conversation, which contained a link to the retired hacker's Komoot profile: https://www.komoot.com/user/5667624959835

What is the retired hacker's full name?

You can find his full name on his Komoot profile.

He links to his GitHub profile: https://github.com/jiml33t

In which city is he located?

Unfortunately, neither his Komoot profile nor his GitHub profile provides any information about the city he lives in. If you Google his name Jim Lee, you'll find a ton of results about the famous comic book artist. It's clear that this isn't the Jim Lee we're looking for. You can find his Instagram account by searching for his GitHub username, jiml33t: https://www.instagram.com/jiml33t. His Instagram bio links directly to his Threads profile: https://www.threads.com/@jiml33t. One of his recent posts includes a photo of the last run he did before the big day.

I used ExifTool to extract the image's metadata, but it didn't contain any usable information. Next, I checked the image for any important details that could help identify the location. If you zoom in far enough, you can see the text irigatii.ro written on the wall of the leftmost building.

A quick Google search shows that there is indeed a store called irigatii.ro and provides its address, revealing the city where Jim Lee is located.

Submit the name of the tram station where he got off on the 7th of May, 2026

His most recent Threads post was posted on May 7, 2026, so the question refers to that post.

We know where the irigatii.ro store is located, so we also have a pretty good idea of where Jim Lee was when the photo was taken.

In the post, he wrote that he was hopping on the tram for a well-deserved coffee at his favorite French supermarket. The Auchan shown on Google Maps is likely the store he was referring to, since Auchan is a French supermarket chain. There is a tram stop near the Auchan supermarket and its name is the answer we are looking for.

What email address did he accidentally expose?

Finding his email address was a bit tricky because none of his public profiles listed one. I took a closer look at his GitHub profile and found a repository containing only a README.md file.

So far, I haven't found an email address. However, the initial GitHub commit may reveal the author's email address that was configured when the commit was created. By opening the raw patch for that commit, we may be able to find it, as long as it was not hidden for privacy reasons.

To view the commit patch file, add .patch to the commit URL: https://github.com/jiml33t/jiml33t/commit/7b2c8e0a540c36f2e09da5945066020621d6a059.patch

Alternatively, you can use the GitHub API: https://api.github.com/repos/jiml33t/jiml33t/commits

Or run the following command in a terminal using curl:

curl https://api.github.com/repos/jiml33t/jiml33t/commits

After checking the commit metadata, we can confirm that the author's email address is exposed.

What is his phone number?

Finding his phone number was trickier than finding his email address. Unlike the previous steps, which relied on passive OSINT techniques, this part of the challenge required active OSINT.

To obtain the phone number, I had to send an email to the address discovered earlier. Sending an email is considered active OSINT because it involves direct interaction with the target and may reveal that an investigation is taking place.

Conclusion

The Cache Me Outside room was a practical OSINT challenge that demonstrated how small pieces of publicly available information can be combined to identify a person and trace their online activity.

By analyzing profiles, images, location details, and GitHub commit data, I was able to find the required information. The final step also demonstrated the difference between passive OSINT and active OSINT, as obtaining the phone number required sending an email. The room was a good reminder that even small details can reveal sensitive information when combined and analyzed carefully.