EXIF metadata viewer
Read EXIF, GPS coordinates, camera details, timestamps, and embedded comments from images - the metadata that answers OSINT challenges.
Open in ctfpalEXIF is a metadata block that cameras and phones write into images. In CTF it is the answer to two kinds of challenge: OSINT questions about where a photo was taken, and hiding places where an author has stuffed a flag into a comment field nobody reads.
It is worth checking even when the challenge gives no reason to. EXIF survives most editing workflows, it is written automatically without the photographer’s involvement, and almost nobody strips it - so it routinely answers questions the challenge author did not intend to leave answerable.
The fields that matter
| Field | Why you care |
|---|---|
| GPSLatitude / GPSLongitude | Exact location - feed it to the coordinate converter |
| DateTimeOriginal | When, to the second - often the answer to a timeline question |
| Make / Model / Software | Which device, and whether the image was edited |
| UserComment / ImageDescription | Free-form text - a common flag hiding place |
| ThumbnailImage | An embedded copy that may predate an edit to the main image |
Part of a module
7. File forensics and carving
Identify files by their bytes, find data appended past a format’s end marker, and pull evidence out of images and documents.
Practise on real challenges
Related tools
JPEG marker and segment analyzer
Parse JPEG markers, read APP segments and comments, and extract data appended after the end-of-image marker.
PNG chunk analyzer
Walk a PNG chunk by chunk, validate CRCs, read tEXt and zTXt metadata, and find data hidden after IEND or in non-standard chunks.
GPS coordinate converter (DMS, decimal, UTM)
Convert between degrees-minutes-seconds, decimal degrees, and other coordinate notations - for EXIF locations and OSINT challenges.
File type identifier by magic bytes
Drop a file and identify what it really is from its signature, regardless of extension. Also finds file headers embedded inside other files.