DEV Community

Enoch Franco
Enoch Franco

Posted on

How I Found My First CTF Flag Hidden in an Image's Metadata

#ctf #cybersecurity #forensics #beginners

Why I Tried This

I've been working through picoCTF's Forensics module lately, and "information" was the very first challenge in it — a beginner-level puzzle meant to ease you into digital forensics. The prompt was simple but a little cryptic:

"Files can always be changed in a secret way. Can you find the flag?"

Along with the prompt was a single file: cat.jpg. That's it. No obvious clues in the image itself — just a photo of a cat sitting on a laptop. So the challenge was clearly not about looking at the image, but about looking inside it.

This post walks through exactly how I solved it, the mistakes I hit along the way, and why each step actually works — not just what to type.

Setting Up ExifTool on Windows

Since every photo carries hidden metadata (camera info, timestamps, sometimes a lot more), my first move was to inspect the file's metadata using ExifTool, a free command-line tool for reading and editing this kind of data.

Here's how I set it up on Windows:

  1. Downloaded the Windows build from exiftool.org.
  2. The extracted executable was named exiftool(-k).exe — not exiftool.exe. I renamed it, which meant first turning on file name extensions in File Explorer (View tab → check "File name extensions"), since Windows hides them by default and that was silently blocking my rename attempts.
  3. Moved exiftool.exe into the same folder as cat.jpg.
  4. Opened PowerShell in that folder (Shift + right-click → "Open PowerShell window here").

Hitting My First Snag

Naturally, I typed the obvious command:

exiftool cat.jpg
Enter fullscreen mode Exit fullscreen mode

And got hit with:

exiftool : The term 'exiftool' is not recognized as the name of a cmdlet, function, script file, or operable program.
Enter fullscreen mode Exit fullscreen mode

Confusing, since the file was right there in the folder. Turns out: PowerShell doesn't search your current folder for programs by default — it only checks a trusted list of folders called the PATH. Windows does this deliberately, as a security measure. If it auto-ran anything sitting in your current directory, it'd be trivially easy for malware to drop a fake file named dir.exe in a folder you're likely to open and trick you into running it.

The fix is to explicitly tell PowerShell "run this file from right here":

.\exiftool.exe cat.jpg
Enter fullscreen mode Exit fullscreen mode

The .\ prefix bypasses the PATH search and points directly at the file. That worked immediately.

Spotting the Flag in the Metadata

Running ExifTool dumped a long list of metadata fields — most of it completely mundane: file size, image dimensions, bits per sample, resolution. Normal stuff every JPEG has.

But a few fields stood out as unusual for a random photo of a cat:

Copyright Notice   : PicoCTF
Rights             : PicoCTF
License            : cGljb0NURnt0aGVbfbTN0YWRhdGFfMXNfbW9kaWZ...
Enter fullscreen mode Exit fullscreen mode

A cat photo has no legitimate reason to carry a "License" field — that's a strong sign someone planted something there on purpose. And the value wasn't normal text; it was a long, uniform jumble of letters and numbers with no spaces. That specific shape is the classic fingerprint of Base64 encoding.

A Quick Note on Base64

Base64 isn't encryption — it's just a way of representing data using a safe set of 64 characters (A–Z, a–z, 0–9, +, /). It doesn't hide meaning or require a key; it just reformats data so it survives being passed through systems that can't handle raw binary safely (old email protocols, metadata fields, URLs, etc.). Anyone can decode it instantly.

It shows up constantly in beginner forensics CTFs as a light layer of obfuscation — enough that you can't just grep the file for picoCTF{ in plain text, but easy to reverse once you recognize the pattern:

  • Random-looking letters and numbers, often padded with = or ==
  • Length is always a multiple of 4
  • No spaces or unusual symbols

Decoding the Flag

Since I was already in PowerShell, I decoded the string directly with .NET's built-in Base64 decoder — no extra tools needed:

[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('PASTE_FULL_LICENSE_STRING_HERE'))
Enter fullscreen mode Exit fullscreen mode

That printed the flag in plain text, in the format picoCTF{...} — ready to submit.

Key Takeaways

  • Metadata is a real attack surface. Files carry more information than what you see on screen — EXIF data is a good first place to check in any forensics challenge.
  • Anything that looks "out of place" in metadata is worth investigating. A License or Copyright field on a personal photo doesn't belong there naturally.
  • Recognize Base64 by shape, not by guessing. Random-looking text with no spaces, uniform character set, length divisible by 4 — that's your cue to decode.
  • Understand why a command works, not just that it works. The PowerShell PATH issue is a perfect example — knowing why .\ was needed means I won't get stuck on it again.

What's Next

I'm planning to keep working through picoCTF's forensics and general skills categories and documenting each solve here. If you're also starting out with CTFs, I'd love to hear what tripped you up first — metadata challenges, encoding puzzles, or something else entirely.

Tags: #ctf #cybersecurity #forensics #beginners #picoCTF

Top comments (0)