A lot of OSINT challenges hand you a file — a photo, a PDF, a Word document — and nothing else. The temptation is to stare at what's rendered on screen, but the flag is frequently sitting a layer below that: in the metadata the file format carries around without ever displaying it. Cameras, phones, and office software all embed details about how a file was made, and challenge authors love to bury a flag exactly there. Here's what to check and which tools do it fastest.
1. Images: EXIF and beyond
Photos from phones and cameras carry EXIF metadata — timestamps, device model, sometimes GPS coordinates, and any custom comment fields the author added. exiftool is the standard for reading (and writing) it:
exiftool challenge.jpgScroll past the obvious fields (make, model, resolution) and look for anything unusual: a Comment, UserComment, or Artist field with a long string is a common place to stash a flag. PNGs don't use EXIF but support their own text chunks — exiftool reads those too, and strings challenge.png | grep -i flag is a fast sanity check either way.
2. PDFs
PDF metadata lives in the document info dictionary and, in newer files, an embedded XMP block. Both show up with the same tool:
exiftool document.pdf
pdfinfo document.pdfLook at Author, Creator, Producer, and Title — these are free-text fields that PDF-generating software populates from whatever the author typed, which makes them an easy hiding spot. It's also worth extracting embedded files and attachments with pdfdetach -list document.pdf, since a flag sometimes rides along as a hidden attachment rather than in the metadata itself.
3. Office documents (.docx, .pptx, .xlsx)
Modern Office formats are just ZIP archives. Unzipping one exposes an XML tree, including docProps/core.xml and docProps/app.xml, which hold the same kind of author/title/comment fields as a PDF — plus full revision history in some cases:
unzip -o report.docx -d report_extracted
cat report_extracted/docProps/core.xmlBecause it's a plain ZIP, a quick grep -r flag report_extracted/ across every extracted XML file is often faster than reading each one by hand, and it also catches flags left in comments or tracked changes that never got fully removed before the file was handed out.
A quick checklist
- Run
exiftoolon every file first — it understands images, PDFs, and most office formats in one command. - Check free-text fields specifically: comment, author, title, subject.
- If the format is a ZIP in disguise (docx/pptx/xlsx, and some others), extract it and grep the XML.
- Don't skip
strings— it's crude, but it catches anything the structured tools don't know how to parse.
Wrapping up
Metadata checks take seconds and cost nothing, which is exactly why they're worth doing on every file an OSINT challenge gives you before moving on to harder techniques. If you're new to the category, the Getting Started with CTF guide covers where OSINT fits alongside the other challenge types, and our writeups section has full walkthroughs where this exact trick shows up in practice.