I focused on the CCTV footage from that night.
There I was, a solitary figure on a motorcycle, racing through the darkened streets. The camera couldn't capture the Harbinger or the demon, of course, but I could see them clearly in my mind's eye. The memory of the Harbinger's swift movements and the demon's icy fury sent a shiver down my spine.
As I scanned the footage, I noticed something else. A figure, partially obscured by shadows, was crouching behind a dumpster, their eyes wide with fear. I zoomed in, and my heart skipped a beat.
It was a girl, her features delicate and her expression filled with a mix of terror and fascination.
"Damn, I scared her..." I mumbled, leaning closer to the screen. "She's cute..."
I quickly took a screenshot of the girl's face, my fingers moving instinctively.
"Let me use OSINT to identify her," I said, turning to Dove and Gilg. "She might live near the minimarket, don't you think?"
I opened a terminal window on the laptop and navigated to a directory containing a facial recognition tool.
[cd face-osint]
[sudo su]
[./fosint /root/usr/save/face.png facescan --open-source -location Indonesia]
I pressed Enter, initiating the search. The program began analyzing the girl's facial features, comparing them to a vast database of images from Indonesian social media platforms and public records.
The terminal screen buzzed with activity as the program tirelessly searched for a match. After what felt like an eternity, a list of potential matches appeared, each accompanied by a photo and a social media profile link.
My eyes scanned the list, my heart pounding with anticipation. One name stood out among the rest:
[Name: Nana Putri]
[Age: 21]
[Location: Tangerang]
[Social Media: InstingConnection @natri_, Lime: Nono_Kokkuuu]
"I think I found her," I announced, a surge of excitement in my voice.
"Nana Putri, Interesting... She's a college student, and Tangerang is quite a distance from here. What was she doing in Depok?"
I clicked on her Instagram profile, revealing a small account with a handful of posts. One photo, in particular, caught my eye - a picture of her at a university campus. "Nas University," I read aloud.
"That's a private college, isn't it?"
I pulled out my phone and sent a quick message to Gilg.
[Me: Gilg, is it easier to find someone by manually stalking their social media, or should I hack into a company or institution that might have their information?]
[Gilg: It's definitely easier to hack into a large organization and access their database.]
I put my phone away and searched for the Nas University website on my laptop.
"This is it," I muttered to myself, a determined glint in my eyes. "Let's see what I can find..."
I copied the university's website link and ran a scan to determine its content management system (CMS).
The results quickly appeared on the screen:
"MySQL... WordPress, PHP... yep, definitely stores student information. Now, let's see what I can find in the WordPress database..."
I opened a new terminal window and launched a specialized tool.
[cd wp-exploit]
[goesthroughwp –url nasuniv.ac.id --enumerate vp --api-token ISJHLFUHOI28VAN8E2HFY8FEO1N1U1]
I hit enter, initiating the scan. I knew this could take a while, so I left the laptop to do its work and lay down on the bed.
"Ahh..." I sighed, closing my eyes. "Can't deny that girl is pretty cute..." The image of Nana Putri, with her innocent eyes and gentle smile, flashed through my mind. I had to admit, I was intrigued.
Ting! A notification flashed on my phone screen. I opened the message, a smile spreading across my face as I saw it was from Dove.
[Dove: Xian, the money is in my account. Let me know what land you want to invest in.]
Hmm, what land should I invest in...?
I wracked my brain, trying to recall any promising locations or properties I had heard about.
[Me: No idea. Give me some recommendations.]
[Dove: Let me ask my friends for suggestions.]
I put my phone away, a sense of anticipation building within me.
Looks like I'll be a landowner at this age after all, I thought, a chuckle escaping my lips.
I got out of bed and went to my laptop, where the scan of Nas University's website had finished.
"Let's see what vulnerabilities we've got here," I muttered, scrolling through the results. The screen was filled with lines of red text, indicating numerous potential weak points.
I focused on one particular vulnerability and copied the link. With a click, it opened in my browser, revealing an admin login page.
"Admin login page..." I mused. "Interesting..."
I returned to the terminal and typed in a new command:
[goesthroughwp --url nasuniv.ac.id --enumerate u --api-token ISJHLFUHOI28VAN8E2HFY8FEO1N1U1]
The program began scanning for usernames within the website, hopefully including an admin account.
Wait, what should I do once I find a username? I wondered, a frown creasing my brow.
I grabbed my phone and quickly messaged Gilg.
[Me: After I find an admin username, what should I do?]
[Gilg: Try to guess the password, or maybe try SQL injection with 'admin' OR '1'='1'.]
I blinked, trying to process his advice.
Huh... okay, I guess? I thought, feeling a mix of excitement and apprehension.
I sat back in the chair, my fingers hovering over the keyboard. Here goes nothing, I thought, taking a deep breath and wishing for luck as I initiated the username enumeration.
The scan completed, revealing three potential admin usernames:
[Username: Adminlum]
[Username: AdminIko]
[Username: AdminNas]
Hmm, from these three, AdminNas seems the most likely to have full access, I deduced.
I opened the admin login page again and typed in the username, followed by the SQL injection code Gilg had suggested. I hit enter, my heart pounding with anticipation.
...
Error.
I sighed, a wave of frustration washing over me.
Of course, it wouldn't be that easy. They wouldn't be using such a basic vulnerability.
I scrolled back through the terminal output, my eyes scanning the lines of code for any clues. Then, a flash of red caught my attention. It was a warning message, highlighting a potential XSS (cross-site scripting) vulnerability in the website's code.
A XSS vulnerability... that's it!
I thought, a spark of excitement igniting within me. This could be the key to bypassing the login page and accessing the university's database.
< Chapter 066 > Fin.