TryHackMe's "OHSINT" Challenge Walkthrough

In the world of cybersecurity, one of the key skills is gathering intelligence from open sources, often referred to as Open-Source Intelligence (OSINT). In this post, I’m going to take you through my experience completing the "OHSINT" challenge on TryHackMe. It’s a great exercise for honing your OSINT skills, and I’ll walk you through the steps I took to solve each of the questions.

What is the User’s Avatar of?

The first question is deceptively simple: What is the user’s avatar of? Initially, the image didn’t provide any useful metadata, so we had to dig deeper. The first step was to download the image, labeled WindowsXP.jpg.

While it didn’t reveal any obvious details directly, I decided to use a handy tool called ExifTool to examine the image metadata.

ExifTool is an incredibly useful tool that allows you to pull hidden data from images, including information like the photographer’s name or any geotagging data that may have been embedded in the file. After running ExifTool on the image, we found the name "OWoodflint" in the metadata. This provided a solid lead.

A quick search of the name online led me to a profile on x.com, where I discovered that the user’s profile picture was of a cat. Simple enough, but a great start!

Answer: The user’s avatar is a cat.

What City is This Person In?

Next, we were tasked with finding the city of the person in question. This one was straightforward once I found a link to the user’s GitHub profile, which stated that the user is based in London.

Answer: London.

What is the SSID of the WAP He Connected To?

This one was a bit trickier. The clue was buried in a post where the user had shared their BSSID. From there, I used Wigle.net, a site that maps out Wi-Fi networks, to find the SSID associated with this BSSID. After a quick search, the SSID turned out to be UnileverWiFi.

Answer: UnileverWiFi.

What is His Personal Email Address?

In this step, I was able to find the user’s personal email by checking their GitHub page, where they had made it available for contact purposes. The email address is OWoodflint@gmail.com.

Answer: OWoodflint@gmail.com.

What Site Did You Find His Email Address On?

Since I found the email on the user's GitHub page, the answer here is simply GitHub.

Answer: GitHub.

Where Has He Gone on Holiday?

Digging through the user’s GitHub page once again, I found a link to their personal website. On the homepage, I saw a mention of New York, which is the location the user had recently visited for a holiday.

Answer: New York.

What is the Person’s Password?

The final challenge was to find the user’s password. This one required a bit of creativity. While inspecting the website, I randomly selected all the page items (Ctrl + A) and noticed some hidden text pop up. It turned out that the password was embedded in white text on the page, making it invisible to the casual observer. After revealing the hidden text, I discovered that the password was “pennYDr0pper.!”

Answer: pennYDr0pper.!