It’s in the article. Login pages for the systems were left open to the Internet on their website. Using the objects delivered during that session, they were able to reconstruct some of these systems. Basically viewing the page source to get more information on what things could be.