Previous: Week 1
Week 2 is here and we have another question for the Magnet Forensics weekly CTF. This week we will delve into some web browser artifacts.
Challenge 2 (OCT 12-18) PIP Install (30)
What domain was most recently viewed via an app that has picture-in-picture capability?
The wording threw me off a little bit at the start. I assumed looking for a domain meant something related to web browsers. Since this is an Android phone and I knew Chrome has picture-in-picture, it had to be somewhere to start. Utilizing ALEAPP for a quick parse, we can look at the Chrome History and sort by the Last Visit Time.
As seen from the screenshot below, malliesae.com was most recently visited, which ended up being the answer.
For what it's worth, malliesae.com was also ranked 0 under the Chrome Top Sites for most recently visited as well.
