DEV Community

Cover image for OhSINT! Complete CTF Writeup for Try Hack Me Beginners
christine
christine

Posted on

OhSINT! Complete CTF Writeup for Try Hack Me Beginners

Imagine a world where you can cyber stalk someone you barely know and not seem like a weirdo. Well, in today's CTF writeup you can! The OhSINT CTF on Try Hack Me allows you to put your stalking skills to use, and it all starts with a picture. 📸

First things first. Open-source intelligence (OSINT) (or oh shi-) refers to the collection and analysis of data gathered from open sources such as sources found over the internet to produce actionable intelligence on a subject.

Okay, gone with you boring information. Let's start hunting!

Task 1: OhSINT

Before we begin with answering the questions, let's download the task files which contains our image. Once you've loaded up your image, right click and open up its properties. When we go into the details, we can identfify the author of the image: OWoodflint.

OhSINT
OhSINT

Let's see what we can find about our new friend OWoodflint by Googling them. We can see that OWoodflint has three profiles: Twitter, GitHub, and a personal blog.

OhSINT

OWoodflint's Twitter

OhSINT

OWoodflint's GitHub

OhSINT

OWoodflint's Blog

OhSINT

Now that our basic hunting is over, let's start answering questions!

What is this users avatar of?
Let's have a look at their Twitter. It's obviously a racoon. 🦝
OhSINT
OhSINT

What city is this person in?
If we go over to their GitHub, we can see that they stated in their README.md that they are from London.
OhSINT
OhSINT

Whats the SSID of the WAP he connected to?
When we go over to their Twitter we can see that they made a tweet about their "free wifi". We can use this BSSID to find the SSID of the WAP they connected to.
OhSINT

To do this, we need to go over to Wigle.net. Register for an account, and once you've done that head over into view > advanced search. Paste in the BSSID they tweeted and let the good times roll. 😎
OhSINT
OhSINT

What is his personal email address?
Back to their GitHub profile and all will be revealed.
OhSINT
OhSINT

What site did you find his email address on?
OhSINT

What site did you find his email address on?
When we head over to their blog, we can see that they recently went on holiday to New York.
OhSINT
OhSINT

What is this persons password?
For this we need to view the page source of their website. You will find the answer to this in a hidden

tag underneath their intro paragraph.

OhSINT
OhSINT

Conclusion

Congratulations! You are now a certified stalker(this is a joke, OSINT is very useful and unlike stalking, legal). I made you a certificate because you deserve it:
OhSINT

See you next time. Happy hacking! 😊

Visit my GitHub for more.

Top comments (0)