A photograph is more than the pixels you see. Cameras and phones quietly write a block of metadata into the file — information about the picture that travels inside it whenever the file is copied, emailed, or uploaded.
The most important of these for security is EXIF (Exchangeable Image File Format). An EXIF block can record:
- the exact GPS coordinates where the photo was taken,
- the date and time, often to the second,
- the camera or phone make, model, and lens,
- and a free-text comment field where secrets are sometimes left behind.
Because this data is hidden from the casual viewer, people publish it without realising it is there. An investigator who reads it — combined with visual cues in the image itself — can determine where a person was and when. This activity is a core open-source intelligence (OSINT) skill and falls under the information-gathering phase of a security assessment — the next step defines OSINT precisely.
In this lesson you will:
- Understand what metadata is and where EXIF GPS data hides.
- See how metadata and visual cues combine into geo-stalking, and why it is a privacy harm.
- Inspect an image's metadata with a tool such as
exiftool. - Learn the durable defence: strip metadata on the server at upload time, never relying on the client.
Estimated time: 10 to 15 minutes.
Note on the target: NovaCart demonstrates this on its Photo Wall (/vuln/nebula-photos) through the Meta Geo Stalking, Visual Geo Stalking, and Leaked API Key challenges. The exact images and security questions are version-dependent, so the lesson also includes an image-you-control exercise — the extraction technique works against any image that carries metadata.
When you are ready, send the Continue signal.