Brunn at 17:31, 2 May 2025

2025-05-02T17:31:56Z

← Older revision		Revision as of 17:31, 2 May 2025
Line 110:		Line 110:
	* Check uncommon tags or MakerNotes if standard tags yield nothing.		* Check uncommon tags or MakerNotes if standard tags yield nothing.

	[[Category:~~Tool~~]]		[[Category:Tools]]
	[[Category:Forensics]]		[[Category:Forensics]]

Brunn at 17:31, 2 May 2025

2025-05-02T17:31:42Z

← Older revision		Revision as of 17:31, 2 May 2025
Line 109:		Line 109:
	* Try extracting thumbnails/previews with <code>-b -ThumbnailImage</code>, <code>-b -PreviewImage</code> etc. - sometimes they differ from the main image or contain hidden info.		* Try extracting thumbnails/previews with <code>-b -ThumbnailImage</code>, <code>-b -PreviewImage</code> etc. - sometimes they differ from the main image or contain hidden info.
	* Check uncommon tags or MakerNotes if standard tags yield nothing.		* Check uncommon tags or MakerNotes if standard tags yield nothing.

			[[Category:Tool]]
			[[Category:Forensics]]

Brunn: Created page with "== ExifTool CTF Quick Reference == === Introduction === ExifTool, created by Phil Harvey, is an extremely powerful command-line application and Perl library for reading, writing, and manipulating '''metadata''' in a vast range of file types. Metadata is "data about data" – information embedded within a file that describes its properties, origin, creator, location, and more. In CTFs, ExifTool is indispensable for: * Extracting hidden flags or clues embedded in metadat..."

2025-05-02T17:31:05Z

Created page with "== ExifTool CTF Quick Reference == === Introduction === ExifTool, created by Phil Harvey, is an extremely powerful command-line application and Perl library for reading, writing, and manipulating '''metadata''' in a vast range of file types. Metadata is "data about data" – information embedded within a file that describes its properties, origin, creator, location, and more. In CTFs, ExifTool is indispensable for: * Extracting hidden flags or clues embedded in metadat..."

New page

== ExifTool CTF Quick Reference ==

=== Introduction ===
ExifTool, created by Phil Harvey, is an extremely powerful command-line application and Perl library for reading, writing, and manipulating '''metadata''' in a vast range of file types. Metadata is "data about data" – information embedded within a file that describes its properties, origin, creator, location, and more.

In CTFs, ExifTool is indispensable for:
* Extracting hidden flags or clues embedded in metadata comments, author fields, GPS coordinates, etc.
* Identifying the software used to create or modify a file, which might hint at specific vulnerabilities or techniques.
* Analyzing file properties beyond simple extensions (e.g., confirming image dimensions, document authors).
* Extracting embedded images like thumbnails or previews.

It supports a huge number of file formats (images like JPEG, PNG, GIF; documents like PDF, Office; audio/video like MP3, MP4, AVI) and understands thousands of different metadata tags (EXIF, IPTC, XMP, GPS, MakerNotes, and many more).

=== Basic Reading ===
'''Goal:''' View all metadata found in a file.
<syntaxhighlight lang="bash">
exiftool <filename>
</syntaxhighlight>
* This outputs all extracted metadata groups and tags with human-readable descriptions.

'''Goal:''' View metadata with shorter tag names (often easier to parse).
<syntaxhighlight lang="bash">
# Show only tag names (keys), not descriptions
exiftool -s <filename>

# Show very short tag names (keys) and values only
exiftool -S -s <filename>
</syntaxhighlight>

=== Reading Specific Tags ===
'''Goal:''' Extract only the value(s) of specific metadata tags.
<syntaxhighlight lang="bash">
# Get the value of the 'Comment' tag
exiftool -Comment <filename>

# Get GPS Latitude and Longitude
exiftool -GPSLatitude -GPSLongitude <filename>

# Get Author and Creator Tool
exiftool -Author -CreatorTool <filename>

# Get a tag from a specific group (e.g., EXIF Make)
exiftool -EXIF:Make <filename>
</syntaxhighlight>
* Use the exact tag name (case-sensitive). Find tag names using the basic `exiftool <filename>` command or check the [https://exiftool.org/TagNames/ ExifTool Tag Name documentation].
* Common CTF tags: <code>Comment</code>, <code>UserComment</code>, <code>Author</code>, <code>Copyright</code>, <code>Description</code>, <code>Title</code>, <code>Subject</code>, <code>Keywords</code>, <code>GPSPosition</code>, <code>Software</code>, <code>Make</code>, <code>Model</code>.

=== Searching / Filtering ===
'''Goal:''' Filter output or search within metadata.
<syntaxhighlight lang="bash">
# Use grep to find keywords (e.g., 'flag' case-insensitive) in the output
exiftool <filename> | grep -i 'flag'

# Use ExifTool's conditional processing to print only files containing a specific comment
exiftool -if '$Comment =~ /password/' -Comment <directory>
</syntaxhighlight>
* Combining `exiftool` with `grep` is often the quickest way to search metadata.
* The <code>-if</code> option allows complex Perl-based conditions.

=== Output Formatting ===
'''Goal:''' Get metadata in structured formats or extract binary data.
<syntaxhighlight lang="bash">
# Output in JSON format
exiftool -j <filename>

# Output in XML/RDF format
exiftool -X <filename>

# Extract binary data for a specific tag (e.g., Thumbnail) to a file
exiftool -b -ThumbnailImage <filename> > thumbnail.jpg

# Extract binary data for common preview/thumbnail tags
exiftool -b -PreviewImage <filename> > preview.jpg
exiftool -b -JpgFromRaw <filename> > preview.jpg
</syntaxhighlight>
* <code>-j</code> (JSON) and <code>-X</code> (XML) are useful for scripting.
* <code>-b</code> is essential for extracting embedded images or data streams.

=== Writing / Removing Metadata (Use with Caution!) ===
'''Goal:''' Modify or delete metadata tags. (Less common for *finding* flags, but good general knowledge).
<syntaxhighlight lang="bash">
# Write a comment (creates backup file by default)
exiftool -Comment="This is my secret message" <filename>

# Remove a specific tag
exiftool -Comment= <filename>

# Remove ALL metadata (DANGEROUS - may corrupt some files)
exiftool -all= <filename>

# Prevent backup file creation when writing
exiftool -overwrite_original -Comment="No backup needed" <filename>
</syntaxhighlight>
* ExifTool creates backup files (<code>filename_original</code>) by default when writing. Use <code>-overwrite_original</code> to prevent this.
* Removing all metadata (<code>-all=</code>) can sometimes damage files or remove essential structural information. Be careful!

=== Other Useful Options ===
* <code>-r</code> : Recursively process files in subdirectories.
* <code>-ext <extension></code> : Process only files with specific extensions (e.g., <code>-ext jpg -ext png</code>). Add <code>--ext</code> to include files with no extension.
* <code>-p <format_string></code> : Create custom output formats using tag names (e.g., <code>exiftool -p '$FileName: $ImageWidth x $ImageHeight' <filename></code>).
* <code>-FileTypeCode</code>, <code>-MIMEType</code> : Display file type information.
* <code>-fast</code> / <code>-fast2</code> : Speed up processing by skipping certain tags or parts of files.

=== CTF Tips ===
* Always run <code>exiftool <filename></code> first to see everything.
* Pay close attention to <code>Comment</code>, <code>UserComment</code>, <code>Description</code>, <code>Author</code>, <code>Copyright</code>, <code>Software</code>, <code>GPS...</code> tags.
* Use <code>-s -S</code> for cleaner output when searching for specific known tags.
* Use <code>| grep -i 'keyword'</code> extensively to search the full output.
* Try extracting thumbnails/previews with <code>-b -ThumbnailImage</code>, <code>-b -PreviewImage</code> etc. - sometimes they differ from the main image or contain hidden info.
* Check uncommon tags or MakerNotes if standard tags yield nothing.

ExifTool - Revision history

Brunn at 17:31, 2 May 2025

Brunn at 17:31, 2 May 2025