OhSINT — TryHackMe Walkthrough

OhSINT is a beginner room on TryHackMe that asks a simple question:

"What information can you possibly get with just one image file?"

The answer, it turns out, is a lot more than you would expect.

OSINT (Open Source Intelligence) is the practice of gathering information from publicly available sources — and it's a foundational skill in penetration testing, red teaming, and even threat intelligence.

Tools I used: Google, EXIF Online Viewer, WIGLE

Let's Begin.

After dowloading the task files, it seems there is only one image in the folder. A classic WindowsXP wallpaper . There is nothing else given to us. so lets see what we can find with this.

The very first thing we can do is get the metadata of the provided image. I used an online EXIF viewer for this.

Upload the image into the viewer to get the metadata.

This metadata provides us with a lot of details about this image, including the copyright value which looks like a username. Lets put the name into Google and see what we get.

From the search, we get back an X account, a Github account and a Wordpress blog linked to the user. Interesting! Lets take a look at X first.

I looked around and didn't find anything crazy besides the BSSID they have posted and their cute profile image.

Now we should look for more information about this person. I went back to the Google search and checked out the user's Github.

There was only one repository on the Github: people_finder. Inside, we have more information about this user like location, email and blog. Lets check out the blog next.

Before we go into the blog page, I noticed something strange on the Google search of the blog.

Did you see it?

Looks like another username or a password maybe? Lets look inside.

Nothing too crazy in here but seems like the user is on vacation in New York. I did notice that the text from the search is missing here. Seems a little fishy. Let's look at the page source.

This is actually really funny. The text "pennYDr0pper.!" is written to blend into the background of the blog.

And would you look at that!

Seems like we've got a lot of information now, but we still need the SSID of the WAP the user is connected to — this is basically the name of their WIFI. For this I used WIGLE.net. I pasted in the BSSID we got from the users X account and we have our answer!

Fun stuff!

This room is a great reminder of how much a single image can reveal. A photo's metadata gave up a username, that username led to a GitHub, a blog and an X account, and a bit of source code digging even surfaced a hidden password. Combine that with a BSSID lookup on WIGLE, and you can pinpoint someone's real-world location down to a specific street — all through a simple Google search.

That's really the point of OSINT: most of the time people leak far more about themselves that they realize, just through the small, seemingly harmless details they post publicly.

This is my first write-up in a series where I work through TryHackMe rooms and document my journey. Thanks for reading!

ANSWERS BELOW:

Question 1: What is this user's avatar of?

Answer: Cat

Question 2: What city is this person in?

Answer: London

Question 3: What is the SSID of the WAP he connected to?

Answer: UnileverWiFi

Question 4: What is his personal email address?

Answer: OWoodflint@gmail.com

Question 5: What site did you find his email address on?

Answer: GitHub

Question 6: Where has he gone on holiday?

Answer: New York

Question 7: What is the person's password?

Answer: pennYDr0pper.!