Image OSINT & Geolocation
Identify locations, people, and metadata from images in CTF OSINT challenges.
Image OSINT & Geolocation
Image OSINT is the extraction of intelligence from photographs through metadata analysis, reverse image searching, and visual feature recognition to identify locations, individuals, timestamps, and devices. How it works: Extract EXIF data (GPS coordinates, camera model, timestamps, software); reverse image search (Google Images, Yandex) against indexed billions of photos; analyze visual clues (signs, architecture, vehicles, landmarks, license plates) to narrow geolocation; combine evidence for triangulation. Why it matters: Modern digital cameras embed location and device metadata automatically; search engines index and retrieve images globally; visual artifacts (unique architecture, road signs, infrastructure) uniquely identify locations worldwide; critical for CTF OSINT challenges.
Decision Tree
Step 1: Extract Metadata (EXIF)
The first step is always to check if the file has embedded GPS coordinates or other identifying metadata:
Run exiftool
exiftool image.jpg
# Key fields to look for:
# GPS Latitude / GPS Longitude
# GPS Position
# Make / Model (device used)
# Date/Time Original
# Software (editing software - may reveal OS/app)
# Comment (challenge authors sometimes hide flags here!)Check for GPS coordinates
GPS coordinates appear like: 40 deg 41' 21.01" N, 74 deg 2' 40.67" W
Convert to decimal degrees:
40 + 41/60 + 21.01/3600 = 40.6892°N
74 + 2/60 + 40.67/3600 = 74.0446°WThen search directly in Google Maps: 40.6892, -74.0446
Check all text fields for hidden flags
# Authors sometimes hide flags in Comment or UserComment
exiftool -Comment image.jpg
exiftool -UserComment image.jpg
exiftool -a -u image.jpg # all fields, verboseAlways run exiftool first - it takes seconds and sometimes reveals the answer immediately. Challenge authors may hide flags in the Comment, Artist, Copyright, or ImageDescription fields.
Note: The InVID/WeVerify toolchain may be subject to rate-limits (HTTP 429) or availability issues. If the online service fails, use an offline InVID workflow (download the media and run local verification tools) or alternative services (Yandex/TinEye/Bing Visual).
Step 2: Reverse Image Search
If there's no metadata, identify the location visually:
Best for: General web content, tourist landmarks, widely-photographed locations.
- Go to images.google.com
- Click the camera icon → upload or paste URL
- Or right-click any image in Chrome → "Search image with Google"
Look for: matching locations in results, Wikipedia articles about landmarks, news articles with same scene.
Step 3: Visual Clue Extraction
When reverse search doesn't give an exact answer, analyze the image manually:
Tools:
- GeoGuessr - builds the skill of visual location identification
- Google Street View - verify a suspected location
Step 4: Narrowing Down with Maps
Once you have a country or city:
1. Open Google Maps satellite view
2. Search for identifiable landmarks (bridges, stadiums, tall buildings)
3. Switch to Street View at suspected location
4. Match features: building height, street layout, vegetation
5. Look at the exact angle the original photo was taken fromStep 5: Shadow Analysis
If you see a shadow in the image, you can determine:
- Time of day (shadow direction + length)
- Season (sun angle)
Identify shadow direction
Shadow points directly away from the sun. At noon in the northern hemisphere, shadows point north. At noon in the southern hemisphere, shadows point south.
Go to SunCalc
Visit suncalc.org. Navigate to the suspected location.
Set date and time
Adjust the date/time slider until the sun position matches the shadow direction in the photo.
Confirm or reject the location hypothesis
If the sun position matches, you have confirmed both the location and approximate time. If not, try adjusting the location.
Tools:
- SunCalc - plot sun position at any location/time
- ShadowCalculator
Finding People
For challenges asking you to identify a person:
# Search by name + context
"John Doe" site:twitter.com OR site:linkedin.com
"John Doe" CTF hacker
# Image → find other appearances online
→ Google reverse image search
→ Yandex (often better for personal photos)Aircraft, Ships, Vehicles
Tools Summary
| Tool | URL | Use Case |
|---|---|---|
| exiftool | CLI | Extract EXIF/GPS from any image |
| Google Images | images.google.com | Reverse image search |
| Yandex Images | yandex.com/images | Better for architecture/faces |
| SunCalc | suncalc.org | Sun/shadow position by location+time |
| GeoGuessr | geoguessr.com | Practice visual geolocation |
| InVID/WeVerify | invid-project.eu | Verify image context |
Checklist
Last updated on