OhSINT is one of TryHackMe's most popular OSINT rooms. You're given a single file — the famous WindowsXP.jpg wallpaper — and asked to answer 7 questions purely through open-source intelligence gathering. No hacking tools needed, just ExifTool, a browser, and methodical thinking.
The first thing you always do with an image in OSINT — check its metadata. ExifTool reads all embedded data from the file including camera info, GPS coordinates, author fields, and more.
The output will show many fields. The one that matters immediately is the Copyright field — it contains a name that will be our starting point for the entire investigation.
Take the username OWoodflint and search it on Google, Twitter/X, and GitHub. You'll find a Twitter account immediately.
The Twitter profile picture is the answer to Q1. While on Twitter, look at the tweets — one of them contains a BSSID (a WiFi access point identifier). This is the answer to Q3.
Wigle.net is a crowdsourced WiFi geolocation database. If a WiFi access point has ever been scanned by someone running Wigle's app, its physical location is logged. Take the BSSID from the tweet and search it.
The map will drop a pin on the location. Zoom in to see the SSID (WiFi network name) of that access point — that is the answer to Q4.
Go back to your Google search results for OWoodflint. There will be a GitHub profile. The bio or repository details reveal their email address.
The Google search results also surface a WordPress blog by OWoodflint. The blog post reveals where they are travelling to — answering Q6. Reading the page source (right-click → View Source) reveals a password hidden in a white-coloured font in the page HTML.
| # | Question | Answer | Source |
|---|---|---|---|
| Q1 | Avatar of? | A cat | |
| Q2 | City? | London | Twitter bio |
| Q3 | BSSID? | B4:5D:50:AA:86:41 | Twitter tweet |
| Q4 | SSID? | UnileverWifi | Wigle.net |
| Q5 | Email? | OWoodflint@gmail.com | GitHub |
| Q6 | Holiday? | New York | WordPress blog |
| Q7 | Password? | pennYDr0pper.! | Blog page source |
This room is deceptively simple but teaches a critical lesson — metadata is data. A photo you share online can contain your GPS coordinates, device info, and even a username embedded by the software that created it.
The chain here was: ExifTool → username → Twitter → BSSID → Wigle.net → location. One piece of information unlocks the next. That's exactly how real OSINT investigations work.
The password hidden in white text is also a good reminder — hiding data in plain sight doesn't mean it's hidden. Always check page source.