I met Willow a few years ago, and she helped me with some things at To speed up our communication, I gave her an email at But I had to learn how to create a professional email address, especially Willow didn’t want to have a dot in the email address.

Her email is the password to the file below (Download file).

Hint: Don’t let bounce, disposable, spam-trap and deactivated emails decrease your sending reputation.

Note: Do not contact Willow or the owner (me) of via email or contact form on the site! Be a sourcer, the hint is enough. Spamming will get your IP blocked.

Veuillez ne pas jouer à ces jeux, si vous ne pouvez pas suivre les règles simples ci-dessus!

Download File



Find the e-mail address and open the file containing the password for next level.


The file is a .docx file. I opened it with LibreOffice Writer and it password protected. Based on the description, the password is Willow’s email address. So, I need to find her email address.

docx file

We can click the Willow name in the description and it will open her LinkedIn profile. I found her full name is “Willow Horton”.

Willow Horton LinkedIn Profile

When I click the Contact Info button, There is no email address.

Willow Horton LinkedIn Contact Info

Based on the hint, Willow’s email address is at domain. Also you can confirm it by visiting the company’s Terms of Service page. It’s mentioned that the company’s email address is support AT recruitment DOT camp.

Recruitment Camp Terms of Service

So, we can use search engine like Google to find her email address. I used the following search query:

"Willow Horton" email

But it didn’t return any result.

Google Dorking

Google Dorking

Based on my experience, there are some common email address formats used by companies. Such as:


To automate the process, we can use a tool like Email Permutator+ . Enter the first name and last name, and the domain name and click Permutate button. It will generate the email address permutations.

Email Permutator


There are 34 emails generated by the tool

After that we can verify the email address using a tool like email address verification tool from Email Hippo . Enter the email address and click GO button. It will check if the email address is valid or not. But, skip the email that contains dot (.) in the email address. Because the description mentioned that Willow didn’t want to have a dot in the email address.

“But I had to learn how to create a professional email address, especially Willow didn’t want to have a dot in the email address.”

After inputting some email addresses, I found the valid email address. Which is [email protected].

Email Result

The Hacker’s Way

You can also use some brute force tools to find the password, such as John the Ripper , hashcat , etc. So you don’t need to verify the email address one by one.

In this case, I used Hashcat to crack the password. I don’t know when using John the Ripper the cracking process is failed with the error message No password hashes loaded (see FAQ). The command I used is:

john --wordlist=email.txt hash.txt

Because of that, I used Hashcat instead.

To crack the password using Hashcat, we need to do the following steps:

  1. Copy the generated email addresses to a text file. Example: email.txt

  2. Get the hash of the .docx file using script from John the Ripper. You can download the script from here . The command is:

    python willow.docx > hash.txt

    *The hash.txt file will contain the hash of the .docx file.

    But, Hashcat can’t crack the hash directly. We need to modify it a bit. To do this, all we need to do is delete the string willow.docx: in front of the hash so that the hash looks like this:

  3. Crack the hash using Hashcat. The command is:

    hashcat -a 0 -m 9600 hash.txt email.txt
    • -a 0 is the attack mode. It’s a straight mode.
    • -m 9600 is the hash type. It’s for MS Office 2013 files.
    Hash Modes from hashcat --help

    Hash Modes from hashcat --help

    Hashcat Command

  4. After the process is finished, we can see the password. Which is [email protected].

    Password Cracked

I used the email address as the password to open the .docx file and we can see the actual password of the challenge:

docx file