Linking any Site

So, I had an idea on how to link & track challenge sites that are not officially participating with score scripts in Wechall.

Usually, every site can be scraped in one form or the other, the main problem is proving that the linked account really belongs to the user that is attempting to link, which is why the email address is used currently and you can only link accounts with an email address that is confirmed to belong to you on Wechall. The other site provides the validatemail.php script for that reason.

If the site doesn't provide it (and the score scripts), it can't be linked on Wechall, but.. there's a way around that.
Most sites have some kind of public profile and the user could be asked to make this public profile show some form of token that Wechall defined. (Then after verification it may be removed again)

With that it can be proven the account belongs to the user, replacing the /verifyemail.php script. This public profile at the same time usually also contains the information needed for Wechall => How many challenges this user has solved.
This then only leaves finding out the total amount of challenges the site has which can usually be done by scraping (this might need a dummy account), or if really in doubt by manually updating the total amount of challenges.

Just some examples of sites that could be linked this way:
https://tryhackme.com/p/noother < Completed Rooms = solved_count
Make the user click "Edit Socials" and have him enter https://wechall.net/e637ec62e7e7 as his "Personal Website".

https://app.hextree.io/profile/noother < Flags Found = solved_count
Make the user add https://wechall.net/e637ec62e7e7 as his "Personal Website/Blog"

https://echoctf.red/profile/1434860 < flags = solved_count
Make the user add "e637ec62e7e7" as the Youtube-Channel-ID in his profile

Even if the site doesn't have any functionality to add an arbitrary string to the profile, the profile picture could be misused for that
https://online.pwntilldawn.com/Achievements/5682 < Pwned Machines = solved_count
Make the user upload a Wechall generated image as Avatar image.

This would enable Wechall to track virtually every site in existence, without the lengthy process that is usually involved which often fails completely due to inactivity on either side.

When the user then clicks Update in Account on Wechall, this public profile would be fetched & parsed to get the current score.

What do you think of this idea?
Is it ethical to just do it? Is there any problem with it I didn't think of?

If this idea gets accepted I might just start working on a PR to implement this.

Good idea, smart workaround that could open up a ton of new sites.

Just gotta be careful with scraping and site TOS though; even if profiles are public, some platforms get twitchy about automated pulls.

As long as it’s opt-in, transparent, and respectful of rate limits, it sounds like a clean and ethical solution overall.

Where is the original quangster? Set him free, you bloody AI!!

No man who has walked through war can return as the same person.
The scars may fade from the skin, but never from the soul ;)