Information
by sealldev

easy
Suggested:
#exif
#cyberchef
Information

We are given a cat.jpg
, opening the file it has no flag visually (but a very nice cat).
I start by using exiftool
to extract the metadata of the file:
ExifTool Version Number : 13.10
File Name : cat.jpg
Directory : .
File Size : 878 kB
File Modification Date/Time : 2025:03:13 11:19:36+11:00
File Access Date/Time : 2025:03:13 11:19:55+11:00
File Inode Change Date/Time : 2025:03:13 11:19:54+11:00
File Permissions : -rw-r--r--
File Type : JPEG
File Type Extension : jpg
MIME Type : image/jpeg
JFIF Version : 1.02
Resolution Unit : None
X Resolution : 1
Y Resolution : 1
Current IPTC Digest : 7a78f3d9cfb1ce42ab5a3aa30573d617
Copyright Notice : PicoCTF
Application Record Version : 4
XMP Toolkit : Image::ExifTool 10.80
License : cGljb0NURnt0aGVfbTN0YWRhdGFfMXNfbW9kaWZpZWR9
Rights : PicoCTF
Image Width : 2560
Image Height : 1598
Encoding Process : Baseline DCT, Huffman coding
Bits Per Sample : 8
Color Components : 3
Y Cb Cr Sub Sampling : YCbCr4:2:0 (2 2)
Image Size : 2560x1598
Megapixels : 4.1
The License
header has a value of interest. It looks like Base64 encoding. We can decode this with various tools (CyberChef, Dcode.fr, etc) but I use the base64
utility on the command line:
$ echo "cGljb0NURnt0aGVfbTN0YWRhdGFfMXNfbW9kaWZpZWR9" | base64 -d
picoCTF{the_m3tadata_1s_modified}
Flag: picoCTF{the_m3tadata_1s_modified}
Related Writeups
Cookies
Who doesn't love cookies? Try to figure out the best one. http://mercury.picoctf.net:17781/
#easy
GET aHEAD
Find the flag being held on this server to get ahead of the competition http://mercury.picoctf.net:28916/ Hint: Maybe y ...
#easy
IntroToBurp
Try here to find the flag Hint: Try using burpsuite to intercept request to capture the flag. Hint: Try mangling the re ...
#easy