Tags: images forensics photo image metadata 

Rating:

We get an image which doesn't have much information if you look at it directly. So let's try to find information hidden inside the image. If we upload the photo to [https://fotoforensics.com/](https://fotoforensics.com/), we find that the title is `LITCTF{c0de_`, the description is `t1g2r_`, and that the rights are `orz}` from the XMP metadata. We can assume that these are the first, second, and third/last parts respectively, and we get that the flag is `LITCTF{c0de_t1g2r_orz}`.

Alternatively, we can use the Unix (or Unix-like) utility `strings` to find the XMP metadata itself in the image as XML:
```xml

<x:xmpmeta xmlns:x='adobe:ns:meta/' x:xmptk='Image::ExifTool 12.36'>
<rdf:RDF xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'>
<rdf:Description rdf:about=''
xmlns:dc='http://purl.org/dc/elements/1.1/'>
<dc:description>
<rdf:Alt>
<rdf:li xml:lang='x-default'>t1g2r_</rdf:li>
</rdf:Alt>
</dc:description>
<dc:rights>
<rdf:Alt>
<rdf:li xml:lang='x-default'>orz}</rdf:li>
</rdf:Alt>
</dc:rights>
<dc:title>
<rdf:Alt>
<rdf:li xml:lang='x-default'>LITCTF{c0de_</rdf:li>
</rdf:Alt>
</dc:title>
</rdf:Description>
</rdf:RDF>
</x:xmpmeta>

```
Note that I have replaced the place where there was binary data with `[BINARY DATA]`. Also, note that we could have also used a text or hex editor to find the XMP metadata too.

We can proceed in a similar fashion as the first way to find the flag.