OhSINT – TryHackMe Walkthrough

Introduction

The OhSINT room is a concise yet impactful exercise in Open Source Intelligence (OSINT) — the practice of collecting publicly accessible information from online sources. This challenge begins with just a single image file, and the objective is to uncover as much information as possible about its owner by navigating through various platforms and data sources.

---

Step 1 – EXIF Metadata Analysis

The first step in any OSINT investigation involving an image is to extract its EXIF metadata, which may contain useful details such as the author, GPS coordinates, camera type, or copyright information.

Running an EXIF extraction tool (e.g., exiftool or online viewer) on the provided image revealed a copyright entry under the name "OWoodflint".

Searching this name on Google Images led to a Twitter profile with the same handle, which had an avatar featuring a cat — answering the first question.

---

Step 2 – Locating the User

From the Twitter profile, I cross-referenced the username OWoodflint on other platforms and found a GitHub account.
The GitHub profile explicitly stated that the user lives in London, providing the city location.

---

Step 3 – Wi-Fi SSID Identification

Scrolling through the Twitter account, one post contained the BSSID of a Wi-Fi network:

B4:5D:50:AA:86:41

The BSSID (Basic Service Set Identifier) is essentially the MAC address of the access point. I searched for it on Wigle.net, a global Wi-Fi network mapping service. By restricting the search to the UK, I found the associated SSID:

UnileverWiFi

---

Step 4 – Email Address

On the GitHub profile, the user's personal email address was listed as:

OWoodflint@gmail.com

This answered both the "What is the email?" and "Where was it found?" questions — the source was GitHub.

---

Step 5 – Travel Information

The GitHub profile also linked to a personal blog hosted on WordPress.
Browsing through the blog revealed a post mentioning a recent trip to New York, confirming the holiday destination.

---

Step 6 – Password Discovery

Finally, the challenge asked for the user's password.

Initially, I searched for leaked passwords using the email address on known breach-checking websites. However, these services often require subscriptions, and this led to a dead end.

The real answer was hidden in plain sight — inside the HTML source code of a blog article titled "Hey". By viewing the page source and inspecting just below a paragraph of text, I found the password:

pennYDr0pper.!

This step was a good reminder that in OSINT, answers aren’t always in obvious places and that attention to detail is critical.

---

Conclusion

This challenge demonstrated how a single image can lead to:

• Identifying a social media profile

• Linking to a city of residence

• Finding a Wi-Fi SSID through BSSID lookup

• Obtaining a personal email address

• Discovering travel history

• Recovering a password from a blog source code

The OhSINT room is an excellent example of why individuals should be mindful of the information they share online and how seemingly unrelated data points can be connected to build a detailed profile.