Image Metadata Viewer (EXIF)

Where image metadata hides flags

Image formats reserve dedicated places for free-form text. Cameras and editors fill them with model numbers and software names. CTF authors fill them with flags. The most frequently abused fields:

• JPEG EXIF - the UserComment, Artist, and Software tags accept arbitrary text.
• JPEG comment marker (0xFFFE) - stores raw text outside EXIF.
• PNG tEXt / iTXt / zTXt chunks - key/value pairs that survive most editors. iTXt supports UTF-8.
• GIF comment extension (0x21 0xFE) -free-form text blocks.
• XMP packets - XML metadata embedded by Adobe tools, often verbose.

If the metadata looks empty, the flag may be elsewhere. Try the File Magic Identifier to confirm the file type, the Strings Extractor to scan the entire file for printable runs, and the Hex Viewer to inspect bytes directly. Many picoCTF challenges append data after the canonical end of the image (after a PNG IEND chunk, for example). When that happens this tool surfaces a "Bytes after IEND" row - extract those bytes with dd skip=N or a binwalk extraction.

For LSB stego (the flag is encoded in the low bits of the pixel data, not the metadata), this tool will not help directly. Use zsteg, stegsolve, or a Python script with PIL instead.