HackHub Journalist’s Sister Walkthrough: A Save-Safe Evidence Route

The values in HackHub – Ultimate Hacker Simulator are not a reusable answer key. A guide can tell you to find the Grand Hotel, the BCC editor, a finance manager, or Carl Teller, but the IP, open port, service version, vulnerable subdomain, password hash, router model, and session index on your screen may be different. The reliable walkthrough is a chain of evidence: preserve each result, use it to identify the next target, and do not advance until the objective panel confirms the handoff.

Research was frozen on August 2, 2026, one day after the official 1.0.0 release. The launch notes say The Journalist’s Sister received fixes and small adjustments but no new story content. The guide below therefore covers the single-player investigation from the first missing-person lead to its final evidence choice, while treating every generated value as a field you must read from the current client.

Build a case file before you touch the first target#

Keep a Notepad entry with six fields: person, organization, domain, public IP, service and version, artifact. Add a seventh field whenever a private host, firewall, router, or mail server appears. This is not busywork. The campaign repeatedly turns one category into another, and the most common dead end is attacking a value from two steps ago.

Gate	Input you should already have	Proof that the gate is finished
Hotel	Sister’s name and Grand Hotel lead	Customers List.xlsx is on your desktop and sent in Kisscord
Location	Captured contact IP	readme.txt supplies a working Weechat endpoint
BCC	Article editor and BCC domain	The editor’s account is selected from the dumped users table
Money trail	Verdane X and its financial report	You can enter the finance manager’s mailbox and identify the transfer recipient
Interpol	Unique non-BCC CRM record	A reverse session is active and yields the Carl Teller lead
Final network	Carl’s topology plus firewall and router	Carl’s formerly closed service is open after both barriers are changed

When a command produces a list, record the line that answers the current objective rather than copying the whole output. When a file or message supplies the next target, keep the file until the route is complete. The campaign sometimes asks you to submit an attachment after you have already read it, and reading is not the same state as handing it over.

Turn the Grand Hotel clue into the Reception machine#

Begin in Kisscord and follow the conversation until the missing sister’s name is explicit. Search that name on Twotter. The relevant post points toward the Grand Hotel; use the English place name if localized search results do not surface the expected result. Run the in-game search against the hotel name, take the domain shown by the result, then resolve the domain:

lynx Grand Hotel
nslookup <hotel-domain-from-your-result>
nmap <resolved-hotel-ip> -sV

Do not paste an IP from another save. The checkpoint is that you can report the currently resolved and scanned hotel target through the active dialogue. If the conversation does not advance, compare the domain in your search result with the domain you resolved. Passing a full URL to nslookup, including https:// or a path, can leave you working with the wrong input.

After the next story transition, the dialogue supplies a network value for the hotel. Download or locate NetTree, then run the script from its actual path. The account name and download directory can differ, so use Explorer or pwd rather than assuming a path copied from a screenshot:

python3 <path-to-net_tree.py> <hotel-network-value>

The topology contains several devices. The story target is the host named Reception. Select its mapped public endpoint, scan that endpoint with nmap -sV, and use the open service plus the displayed version to choose a matching Metasploit module. The module index is not a durable answer; use the search result in your session.

msfconsole
search <service-name-from-nmap>
use <matching-module-name-or-current-index>
show options
set RHOST <reception-public-ip>
set RPORT <open-port-if-not-already-correct>
set Version <version-from-this-scan>
show options
exploit

The second show options is the important one. Check every field marked required. A module can be correct while RHOST still points to an earlier machine, RPORT still uses a default closed port, or Version still carries the module’s placeholder. If the exploit fails, re-read those three fields before switching modules.

Once the session opens, launch the in-game file explorer and retrieve Customers List.xlsx. Open the sheet and locate the missing sister. The next lead is the neighboring guest, not a fixed row number. Join the guest’s first and last names when searching, follow the result to the associated organization, and report that connection. Finally, attach Customers List.xlsx in the required Kisscord conversation. A checked “download” objective with an unchecked “send” objective means the evidence is still on your desktop rather than in the chat.

Do not combine achievement cleanup with this story handoff unless you have a backup. Community evidence disagrees on how aggressively to alter sys.log, and a separate Digital Ghost condition appears to care about particular shell records. The story route needs the spreadsheet and the research chain; it does not need a speculative log purge.

Use the intercepted IP twice: first as traffic, then as geography#

Continue the conversations and required transfer until the game gives you an IP tied to the contact. In Wireshark, set the source to the supplied IP and the destination to your own current public IP, then start capture. You are waiting for the distinctive story packet, not merely any changing line. Select the relevant packet and return to the dialogue when the capture objective ticks.

The same captured IP becomes the input for geoip. Preserve both coordinates exactly as displayed, including their signs. Download the WigleNet script from HackDB and pass latitude before longitude:

geoip <captured-contact-ip>
python3 <path-to-wiglenet.py> -lat <latitude> -long <longitude>

WigleNet normally returns more than one device type. Choose the terminal/device endpoint for the next intrusion, not the router entry just because the router also has an IP. Scan the device, match its current open service and version in Metasploit, verify the required options, and exploit it. Open Explorer and find readme.txt. That file contains the current Weechat endpoint and passphrase.

apt-get install weechat
weechat <endpoint-from-readme> <passphrase-from-readme>

If Weechat connects but the objective remains open, re-open readme.txt and compare both fields. An older endpoint saved in Notepad can look valid enough to launch a session while belonging to the previous stage. Complete the conversation, return to the journalist, then watch for the email attachment. Download it and attach that exact file in the requested conversation; forwarding the message text without the file does not satisfy the evidence gate.

The failed BCC breach is the trigger for a different attack surface#

Open the BCC report about the disappearance and record the editor credited on the article. That person is the selection key later; do not start cracking random rows. Resolve the BCC domain, scan it, and attempt the direct breach requested by the objectives. The readable walkthroughs agree that this first attack can fail as a scripted story beat. If the objective advances after the failure, do not keep changing modules in an attempt to force a shell.

The new route is the site’s subdomain surface:

apt-get install subfinder
subfinder -d bcc.com
apt-get install nuclei
nuclei -h <subfinder-output-file>

Use the result marked for SQL injection. The generated hostname can differ, so copy the vulnerable subdomain from the current Nuclei output. Install the required Python package manager and SQLMap by the method supported in your client, then list tables and dump the user table named by the result:

sqlmap -u <vulnerable-bcc-subdomain> -tables
sqlmap -u <vulnerable-bcc-subdomain> -dump -table <users-table>

Return to the editor name you wrote down from the BCC article. Select the matching email row and pass only that row’s hash to john. The success signal is a credential for the story’s editor, not merely any cracked account. If the editor is absent, stop and audit three things: you dumped the table from the Nuclei-identified host, you are reading the disappearance article’s editor rather than another byline, and the preceding failed-breach objective is complete.

After the credential step, read the new BCC material and resume the required Weechat and Kisscord exchanges. This dialogue is a state gate for the financial investigation. Skipping it can leave every later company searchable while the game refuses to acknowledge the result.

Follow the money by preserving each document handoff#

The BCC reporting supplies a list of major companies. Research the names from the article until the Verdane X lead produces a company domain. Resolve or inspect that domain using the current objective, scan the resulting endpoint, and breach the service using the same scan → search → configure → verify → exploit loop. The important artifact on the target is the Q1 2025 financial report.

Read the report before moving it out of the way. It identifies a transaction partner, Nova Energy. Search Nova Energy on Twotter and identify its finance contacts. The manager is the person whose mail infrastructure you trace first. Search that person’s full name for the current email address, then resolve the mail host:

apt-get install mxlookup
mxlookup <finance-manager-email>
nmap <mail-host-from-mxlookup> -sV

Breach the mail server using its live service and version. Inside the server, inspect the request logs under the server files. The target line associates the finance manager’s email with an endpoint IP. That relationship matters more than any example IP shown in a guide.

Attempt the finance manager’s machine when the objectives direct you. If the target is offline or the first intrusion is rejected, follow the campaign’s phishing/onlining prompt rather than repeatedly hammering the same closed state. Once access is available, find the mail cookie file and decode its JWT with the in-game script downloaded from HackDB:

python3 <path-to-jwt_decoder.py> <token-from-cookies-file>

Use the decoded current-save credentials to enter the mailbox. In Sent mail, find the message to the second finance contact. That recipient is the destination for the story’s false transfer email. The referenced route notes that this message needs the recipient and story action, not an unrelated canned template. Send it, then complete the follow-up conversations before searching for the Interpol lead.

The Interpol pivot succeeds only if the listener is ready first#

Search the Interpol clue on Twotter, follow it to the associated business identity, and use in-game search to obtain the business domain. Enumerate and scan its subdomains. The relevant result is a vulnerable CRM host. Use SQLMap to list its tables and dump the table containing customer records.

The selection rule is structural: most records use BCC addresses, while one record uses an outside organization address. That outlier is the Interpol contact you need. Record the full name and email, locate the person’s Twotter profile, and then prepare the document callback.

In Metasploit, search for the office-document macro module and select the reverse TCP payload shown by the current module. Run show options before generating anything. You need a local host and listening port that the in-game router will actually forward.

1. Run ifconfig and record your current private/local address.
2. Open the router page identified in your current network, note its model, and run the downloaded Fern tool using the syntax shown by that tool.
3. Sign in to the router and forward your chosen listener port to the local address from ifconfig.
4. Back in Metasploit, set LHOST and LPORT to those same values, run the module to create the document, and note the actual output filename.
5. Start handler before sending the document to the selected Interpol contact.

Renaming the generated document is harmless only if you still attach the generated file. A mail marked sent does not prove the callback succeeded. Wait for the objective state or a live session, then inspect it:

show sessions
session <active-session-index>
explorer

The index shown in a walkthrough is not reusable; select the session currently listed in your console. Search the target’s files for the Jihad record. That document turns the Interpol contact into the next named target: Carl Teller.

Carl Teller is behind a firewall and a router, not one broken exploit#

Research Carl’s name and use the current session/network clue with NetTree. Identify Carl’s machine, its router, its firewall, and the server candidates in the same topology. Scan Carl’s public endpoint now and keep the output. Seeing the expected service closed is a diagnosis: the machine is not ready for Metasploit yet.

First clear the firewall layer. Open Wireshark with source and destination set to *. Run the Kimai script against the firewall IP from your current topology and watch for a cookie/token packet. The community Handbook notes that a usable token may not appear on every run, so repeat the in-game script while capture is active, then decode the token:

python3 <path-to-kimai.py> <firewall-ip>
python3 <path-to-jwt_decoder.py> <captured-firewall-token>

Use the decoded credentials on the firewall page. Change the two deny policies required by the objective to allow. Do not assume this opens Carl’s public service: the firewall rule and router forwarding are separate states.

Next open the router page. Use the router’s current model with Fern, sign in, and enable or create the required forwarding entries toward Carl’s private host. Save the router configuration. Then run the same nmap -sV scan against Carl’s public endpoint again.

The before/after comparison is the checkpoint. If the service remains closed, do not search for another exploit. Confirm that the firewall rules were saved, the router entries are enabled, the forward destination is Carl’s private address rather than the player’s address, and the forwarded port matches the service you intend to use. Only after Nmap reports the service open should you configure Metasploit with its current port and version.

Inside Carl’s machine, read the Jihad notes. They identify the final server by an ID rather than by a universal IP. Return to the same NetTree map, match that server ID to its current endpoint, scan it, and use the discovered service/version to enter. Read and download the relevant evidence before returning to the journalist.

Make the final evidence choice reversible#

The final branch changes what you do with the evidence already found on Carl’s computer and the server. Make a separate save before deleting or sending anything. The two evidence-backed outcomes are:

• Help the journalist: remove the relevant Jihad evidence from the final server and Carl’s computer when the ending objective asks you to destroy it.
• Expose the journalist: preserve/download the evidence and send the required material to BCC.

Do not delete first and assume the desktop copy can always reconstruct the expose branch. The sources establish the two actions, but they do not prove that every deletion order leaves both choices open. A pre-choice save is the reliable boundary.

If the ending prompt never appears, audit the final chain backward: the server was selected by the ID in Carl’s note; Carl’s note came from his machine after both network barriers opened; the Carl lead came from the live Interpol session; and the session came from the CRM outlier, not an arbitrary customer. This route is long, but every stall is attached to a missing artifact or state transition. Rebuilding that chain is faster than importing another player’s generated values.

Sources & credits#

Identity, AppID 2980270, developer and publishers, the August 1, 2026 release, 1.0.0 boundary, multiplayer separation, launch changes, and the published image were checked against the official HackHub Steam page, Steam metadata, and HotBunny’s official 1.0 announcement. The investigation dependency chain and current-save randomization rule were cross-checked against two readable community walkthroughs; command behavior was checked against a captured community Handbook. A short Eppenstein route, an evolving scripting-API link, a pre-1.0 review, and a generic wiki hub were not used to fill story gaps. The hero is an unmodified official Steam JPG.