OhSINT - TryHackMe Walkthrough

An OSINT (Open Source Intelligence) challenge where you extract information from a single image to uncover details about a person's online presence.

Room URL: https://tryhackme.com/room/ohsint

Difficulty: Easy

Category: OSINT (not a traditional boot2root)

Tools & Techniques Used

• exiftool (image metadata extraction)
• Google dorking
• Wigle.net (WiFi geolocation)
• Social media investigation (Twitter, GitHub, personal blog)

Step-by-Step Walkthrough

1. Analyze the Image

Download the provided image (WindowsXP.jpg) and extract metadata using exiftool:

exiftool WindowsXP.jpg

Key finding:

Copyright: OWoodflint

This is our starting point for OSINT investigation.

2. Google the Username

Search for OWoodflint on Google. You'll find several profiles:

• Twitter: @OWoodflint
• GitHub: OWoodflint
• Personal Blog: oliverwoodflint.wordpress.com (or similar)

3. Twitter Investigation

Visit the Twitter profile. Key findings:

• Avatar: Cat picture (answers Q1)
• BSSID mentioned in a tweet: B4:5D:50:AA:86:41

The BSSID is a MAC address of a wireless access point — this will be useful later.

4. GitHub Investigation

Visit the GitHub profile. Key findings:

• City: London (answers Q2)
• Email: OWoodflint@gmail.com (answers Q4)
• Platform where email was found: GitHub (answers Q5)

5. Wigle.net - WiFi Geolocation

Use the BSSID from Twitter to find the WiFi network name.

1. Go to wigle.net
2. Create an account (free)
3. Go to View → Advanced Search
4. Enter the BSSID: B4:5D:50:AA:86:41
5. Search and zoom into the map marker

Found SSID: UnileverWiFi (answers Q3)

6. Blog Investigation

Visit the personal blog. Key findings:

• Holiday destination mentioned: New York (answers Q6)
• Inspect the HTML source — there's hidden text (white text on white background)
• Password hidden in source: pennYDr0pper.! (answers Q7)

To find the hidden password:

curl https://oliverwoodflint.wordpress.com/ | grep -i password

Or use browser Developer Tools (F12) → inspect the page elements.

Answers Summary

Key Takeaways

• Image metadata often contains valuable information (author, GPS coordinates, copyright)
• exiftool is essential for extracting metadata from images
• Wigle.net can geolocate WiFi access points using BSSID
• Always inspect page source — hidden text and comments may contain secrets
• Username pivoting — one username can lead to multiple platforms
• OSINT skills are crucial for initial reconnaissance in real-world pentesting

OSINT Tools Reference

💬 Join our Discord community: https://discord.gg/CVpyqCek