> For the complete documentation index, see [llms.txt](https://lance-kenji.gitbook.io/me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lance-kenji.gitbook.io/me/swimmer-osint-ctf-2026-writeups/tgt_lilica/lilica_02_virtual_identity.md).
# lilica\_02\_virtual\_identity
### Challenge overview
Lilica is also interested in VR, and some activity has been observed in the future. The objective of this challenge is to identify **the VRChat user ID which lilica was using as of 2026**.
VRChat user information can be viewed in a web browser.
Flag format:
```
SWIMMER{VRCHAT_USER_ID}
```
Example (not the solution):
```
SWIMMER{usr_xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}
```
***
### Initial assumptions
* Lilica may use the same or similar username across platforms.
* VRChat profiles are publicly searchable, but require login to access the full user search.
* The goal is to retrieve the **user ID**, not display name.
***
### Investigation process
1. I registered an account on **VRChat** to access the user search functionality.
2. Using lilica’s X/Twitter display name: `黄昏ブロッサムリリカ`, I searched for the user inside VRChat.
3. Once located, I accessed the profile URL which contained the **user ID**.
URL found:
```
https://vrchat.com/home/user/usr_b103fac6-8341-4b89-a606-920092e75e43
```
***
### Key findings
* Lilica’s VRChat account as of 2026 has the user ID: `usr_b103fac6-8341-4b89-a606-920092e75e43`.
* The user ID is embedded in the profile URL and is publicly retrievable with a VRChat account.
* No direct interaction with the user was required.
***
### Final flag / answer
```
SWIMMER{usr_b103fac6-8341-4b89-a606-920092e75e43}
```
***
### Notes & takeaways
* Usernames and display names can differ from the unique system ID in VRChat; always verify the ID from the profile URL.
* Creating a free account is necessary to access VRChat’s internal search, which is a **lawful OSINT method**.
* This demonstrates how cross-platform identity correlation can be performed using only publicly accessible information.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://lance-kenji.gitbook.io/me/swimmer-osint-ctf-2026-writeups/tgt_lilica/lilica_02_virtual_identity.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.