A Taste of Influence, Part 4 — Finding the Strava Account

Source: A Taste of Influence — Part 4, OSINT Industries CTF Given: the email address and partial phone number recovered in Parts 2 and 3, plus the subject’s name Wanted: the Strava account associated with the subject, as OSINT{STRAVA_ID}

The final part of the series, and the one where the circle closes. Part 1 was solved by reading a profile picture. Part 4 is solved by reading a profile picture. Same principle, different platform, and a neat piece of challenge design once you see it.

The task

The subject is believed to be active in sports and physical training. Given the email and partial phone number recovered earlier, identify the Strava account associated with him.

Flag format: OSINT{STRAVA_ID}.

A note on redaction: the account ID is not reproduced here. Strava is not a contact directory — an account ID resolves to activity history, and activity history on a fitness platform is location data: routes that typically begin and end at a person’s home. That makes this the most sensitive flag in the entire series, and the reason the writeup below stops at method and does not include the ID or anything that resolves to the subject’s movements.

The route, and the route I did not take

The input handed to this part is the email address and the partial phone number. The tempting read is that you are meant to feed one of those into Strava — check whether the email is registered, work a recovery flow, run it through a reverse-lookup service until an account falls out.

Do not do that, and you do not need to. Enumerating a real person’s account through a registration or recovery flow is account-enumeration abuse: you are probing an authentication surface to confirm that a specific human has an account and to pull identifiers the platform never chose to publish. It is also unnecessary here, because Strava already exposes a public athlete search.

The clean route:

1. Open Strava’s athlete search — the ordinary in-product “find athletes by name” feature, available to any logged-in user.
2. Search the subject’s name. Use both romanisations and the original Cyrillic; on a Russian-language platform surface the Cyrillic form is the one that returns results.
3. Read the account ID off the correct profile.

Everything here is data the subject chose to make publicly searchable. The email and phone number from earlier parts end up serving only as confirmation that you have the right person, which is exactly what they should be.

The disambiguation

The name search returned two athletes with the same name. This is the actual task — not “find a Strava account”, but “find his Strava account” — and it is the step the three-line writeups skip.

The tell was almost comically direct. One account had a profile photo; the other did not. The subject is a professional chef, and the account with a photo showed a man in chef’s whites and a logo-branded apron, mid-service.

That is the whole disambiguation. And it is worth noticing what just happened: the deciding evidence was, again, a profile picture — branded workwear on a person who builds a professional reputation around their craft. It is the identical mechanism from Part 1. The series opens by asking you to read an event logo out of an avatar and closes by asking you to pick the right account out of two on the strength of a chef’s jacket. The profile photo was the data field at both ends.

A small methodological note: “has a photo that fits the profession” is strong evidence, not proof. Here it was decisive because the other candidate was empty and the photo content was specific and consistent with everything established in Parts 1 through 3 — same profession, plausibly same city. If both accounts had carried photos, or if the photo had been generic, you would fall back to the harder signals: city on the profile, a username reused from the accounts found in Part 2, activity that starts in the right place. Confirm on the strongest signal available, not the first one that fits.

Takeaway

The series-long lesson, stated once:

A profile picture is a data field, not decoration — at both ends of an investigation.

Part 1 read an event, and a year, out of an avatar. Part 4 resolved an identity ambiguity out of one. On any platform where people build a professional or personal reputation, the image is chosen to say something, and what it says is frequently the most specific, least-guarded data on the page. Open it, read it, and let it break ties.

And the platform-specific warning that outranks the neat symmetry: a Strava ID is location data. The same public-search convenience that solved this challenge in three clicks is, pointed at anyone who has not locked down their privacy zones, a route from a name to a home address by way of where their runs begin. If you take one operational thing from this series, take that one — and go set your own privacy zones.

Sources

• A Taste of Influence — OSINT Industries CTF — the challenge
• Strava — controlling your privacy zones — the defensive countermeasure