OhSINT

Digital Detective: Solving the TryHackMe OhSINT Challenge

Open-Source Intelligence (OSINT) is the art of gathering and analyzing publicly available data to build a comprehensive profile of a target. In cybersecurity, a single piece of forgotten data can unravel an entire identity.

To demonstrate this, we will dive into the popular OhSINT room on TryHackMe. The premise is deceptively simple: we are given a single default Windows XP background image, and from it, we must hunt down everything about its creator.

Here is the step-by-step walkthrough of how the investigation unfolded.

Step 1: Digging into Metadata

When dealing with any media file in an OSINT investigation, the absolute first step is checking the metadata (the hidden data about the file itself).

By running the command line tool exiftool (or using an online metadata viewer), we extract the embedded parameters of the image.

While the image visually looks like a normal desktop background, the metadata reveals two critical clues:

• GPS Coordinates: Points toward a specific global location.
• Copyright: Explicitly registered under the handle OWoodflint.

Now we have a solid pivot point: a unique username.

Step 2: Following the Social Footprint (Twitter/X)

Armed with the username OWoodflint, a quick search on open engines leads us directly to three distinct platforms: Twitter/X, GitHub, and a personal WordPress site.

Let's look at the Twitter profile first.

Visiting the profile answers our first few questions immediately:

• Avatar Check: The user's profile picture is a Cat.
• Location Check: The bio states that the user is located in London.

Furthermore, the user posted a tweet mentioning: "From my house I can get free wifi ;D Bssid: B4:5D:50:AA:86:41". A BSSID is essentially the physical MAC address of a wireless router.

Step 3: Mapping the Network Location via WiGLE

To track down the exact network the user connected to, we use WiGLE.net — a vast public database that maps wireless networks worldwide based on geolocation data.

By creating a free account, navigating to the Advanced Search tab, and filtering by the captured BSSID (B4:5D:50:AA:86:41), the global map narrows down straight to central London.

Zooming into the specific location coordinates reveals the true name (SSID) of the Wireless Access Point: UnileverWiFi.

Step 4: Inspecting GitHub for Leaked Credentials

Our initial search also pointed to a public GitHub repository managed by the target. Developers frequently make the mistake of leaving contact details or development notes inside code files.

Checking the repositories under OWoodflint's profile uncovers an explicit repository. Right inside, we discover the user's personal email address listed cleanly in the documentation: OWoodflint@gmail.com.

Step 5: The WordPress Blog & Hidden Plaintext

Finally, we pivot to the WordPress website discovered during our intelligence gathering. The blog itself contains a casual post mentioning that the target went on holiday to New York.

However, looking at the web page visually doesn't show any passwords. To dig deeper, we view the HTML Source Code of the site (or simply highlight all elements on the page).

In a classic CTF-style mistake, the developer embedded a secret string inside a paragraph tag but styled its color to white (color:#ffffff) to blend invisibly with the background. Inspecting the DOM reveals the hidden password: pennYDr0pper.!.

Summary of the Intelligence Gathered

By chaining simple OSINT techniques together, we solved the entire challenge without writing a single line of exploit code.

• Avatar: cat
• City: London
• SSID: UnileverWiFi
• Email: OWoodflint@gmail.com
• Platform where email was found: GitHub
• Holiday Destination: New York
• Leaked Password: pennYDr0pper.!

Conclusion :)

The OhSINT challenge beautifully illustrates the fundamental law of digital forensics: nothing online is truly isolated.

What started as a simple, generic Windows desktop wallpaper quickly spiraled into a complete identity compromise. By chaining together metadata analysis, social media profiling, OSINT geospatial tools like WiGLE, and code inspection, we constructed an unredacted profile of a target. We mapped their physical address, uncovered their travel history, leaked their email, and extracted their plaintext password — all without executing a single exploit code or cyberattack.

In the modern digital age, your security is only as strong as your weakest public footprint. Whether you are an individual or an organization, continuous digital hygiene — scrubbing file metadata, auditing public repositories, and separating personal handles from professional assets — is no longer optional.

Be mindful of the digital crumbs you leave behind; otherwise, you might just become the next target of an OSINT investigation.