First Ever Writeup: THM OhSint

The image provided from the challenge

I’m a 2nd year IT student who thought I knew a thing or two about staying safe online.

Then I spent 90 minutes on a single challenge — one image file, seven questions — and walked away genuinely unsettled.

Not because it was hard. Because it was easy.

Everything I uncovered came from information that was already public. Already out there. Already waiting for anyone who knew where to look.

This is my first ever CTF writeup. It’s also a reminder — to myself as much as anyone — that thinking before you click might already be too late if you never thought about what you posted.

The Challenge

First Question: What is this user’s avatar of?

My first instinct when given an image file is always the same: run exiftool. Exiftool reads the metadata embedded inside image files — information that most people don’t even know exists. Camera model, GPS coordinates, timestamps, and sometimes, a name. In this case, the metadata revealed a Copyright field with the value: OWoodflint. That one string was all I needed to start pulling the thread.

exiftool result

With the username OWoodflint in hand, I searched it on Google. One of the first results was an X (Twitter) account belonging to that username.

Their profile picture? A cat.

OWoodflint X account

Answer: Cat

Lesson: A username is an identity. The same username used across multiple platforms links everything together — and most people reuse them everywhere.

Question 2 — What city is this person in?

Back in the exiftool output, three rows caught my attention as potential location indicators. The hint for this question pointed toward using a BSSID (a unique identifier for a WiFi access point) and a site called Wigle.net — a database that maps WiFi networks to physical locations.

Here’s where it got interesting: the target had posted their BSSID directly on their X account. Publicly. For anyone to find.

OWoodflint tweet

I plugged that BSSID into Wigle.net’s search. The result came back with coordinates — and I noticed the abbreviation “lon” in the location data.

I guessed London. I was right.

(Full disclosure: that was part educated inference, part luck — but in OSINT, pattern recognition and educated guesses are part of the process.)

Answer: London

Lesson: Your home WiFi’s BSSID is publicly mappable. Posting it online is the equivalent of posting your home address.

Question 3 — What is the SSID of the WiFi network he connected to?

Using Wigle.net’s advanced search feature, I pasted the BSSID retrieved from the tweet. The result returned not just the location, but the full network name (SSID) associated with that access point.

Wigle.net result

Answer: UnileverWiFi

Question 4 & 5 — What is his email address, and where did you find it?

This is where I got genuinely stuck — and I think it’s worth being honest about that.

My instinct was to keep following the same chain: X led to Wigle, Wigle led to the SSID, so surely the next clue would follow the same pattern. It didn’t. I spent time going in circles before I paused and went back to basics.

I searched OWoodflint on Google again — this time without assumptions about where the answer would be. A public GitHub repository appeared in the results. The profile matched our target perfectly, and the repository contained their personal email address sitting in plain sight.

OWoodflint Github repository

Answer: OWoodflint@gmail.com — found on GitHub

Lesson: When you get stuck, reset. Don’t assume the next answer follows from the last one. OSINT is non-linear — go back to the username and search fresh.

Question 6 — Where has he gone on holiday?

With the email address now in hand, I searched it directly on Google. It led me to a personal blog post written by the target — in which they casually mentioned their holiday destination.

OWoodflint blog post

Answer: New York

Lesson: People share more than they realize on personal blogs. A blog post you wrote two years ago and forgot about is still indexed, still searchable, and still readable by anyone.

Question 7 — What is the person’s password?

The hint told me to check the page’s source code.

I opened the blog post, right-clicked, and viewed the page source. Buried inside the HTML was a string that immediately looked out of place — the kind of thing that has no business being in a webpage’s source code.

<p style="color:#ffffff;" class="has-text-color wp-block-paragraph">pennYDr0pper.!</p>

I tried it as the password and it worked.

Answer: pennYDr0pper.!

Lesson: Sensitive information left in source code — even on a forgotten personal blog — is fully exposed to anyone who knows to look.

Final Thoughts

After submitting that last flag, I sat back and felt two things at once: satisfaction, and a kind of quiet unease.

Satisfaction because I completed my first room without using AI. I got stuck. I used hints. I made a lucky guess or two. But every answer came from my own reasoning and the tools in front of me — and that felt meaningful in a way that copy-pasting an AI answer never would.

The unease? That came from realizing how little it took. One username. One metadata field. A handful of Google searches and a free website. From a single image file, I built a profile that included someone’s city, their WiFi network, their email, their travel plans, and their password.

None of it required exploits. None of it required hacking in the Hollywood sense. It required patience, curiosity, and knowing where to look.

That’s what OSINT is. And that’s why it matters.

If you want to try it yourself: TryHackMe — OHsint