# Photo geolocation OSINT CTF: read a picture for its answer Published: 2026-11-11 · Updated: 2026-11-03 · By HackerGPT Team Canonical: https://hackergpt.org/blog/photo-geolocation-osint-ctf/ > How a photo OSINT CTF recovers a security answer from what a picture shows, why clean metadata did not help, and what to check before you post photos of your own. **TL;DR:** A photo leaks in two layers: the file (EXIF metadata such as GPS and camera details) and the picture itself (signs, logos, landmarks, captions). In CyberGym's "Visual Geo Stalking" challenge the file carries no metadata at all, yet a company logo visible in a window, plus the caption "My old workplace...", answers the account's security question. Before you post a photo, check both layers — stripping metadata does nothing about what the picture shows. This is for learners practising OSINT and for anyone who posts photos online. You will see how the challenge works on [CyberGym](https://cybergym.hackergpt.app), how the tester in the video solved it by hand, what the file itself contains, how HackerGPT's CTF Mode solved it in the run that closes the video, and a short pre-posting checklist for your own pictures. CyberGym is a legal, deliberately vulnerable practice target; apply these techniques only to targets you own or are permitted to test, and to your own photos. [Watch on YouTube: CyberGym Challenge: Visual Geo Stalking](https://www.youtube.com/watch?v=M7HI0fHcAoA) CyberGym runs [OWASP Juice Shop](https://owasp.org/www-project-juice-shop/), and "Visual Geo Stalking" is one of its *Sensitive Data Exposure* challenges: determine the answer to Emma's security question from a photo she uploaded to the Photo Wall, then reset her password ([OWASP Juice Shop companion guide](https://pwning.owasp-juice.shop/companion-guide/latest/part2/sensitive-data-exposure.html)). Emma is a fictional Juice Shop character, so nothing here searches a real person. ## What is photo geolocation in OSINT? It is working out where a photo was taken, or what it reveals about the person who took it, from the image alone. Investigators read two things: **metadata** embedded in the file, such as the GPS coordinates and timestamps many phone cameras write into EXIF, and **visual content**, such as shop signs, logos, street furniture, architecture and anything written in the frame. The Juice Shop project teaches both on purpose. A sibling challenge, "Meta Geo Stalking", is solved by reading a photo's metadata; this one is solved by looking. The companion guide's hint for it says exactly that: "Take a look at the details in the photo to determine the location of where it was taken" ([companion guide](https://pwning.owasp-juice.shop/companion-guide/latest/part2/sensitive-data-exposure.html)). ## How do I find the question I need to answer? Read it off the reset form. Juice Shop returns any account's security question from an endpoint that needs no login, and the account's email follows the pattern you can see on any product review (`@juice-sh.op`). The video notes the lookup is case-sensitive: a lowercase name works. ```bash curl -s "https://cybergym.hackergpt.app/rest/user/security-question?email=emma@juice-sh.op" ``` ```json {"question":{"id":10,"question":"Company you first work for as an adult?","createdAt":"2026-10-29T17:43:06.540Z","updatedAt":"2026-10-29T17:43:06.540Z"}} ``` Now the job is concrete: find the name of Emma's first employer. The challenge text already says where to look — the Photo Wall. ## How do you read a photo for a security answer? Start from the caption, not the pixels. The Photo Wall (in the side menu) shows uploads with captions and uploader names, and not every image says who posted it. One upload is captioned "My old workplace..." and posted by a handle that plays on Emma's name. "Old workplace" maps directly onto "first company you worked for", so that is the image to study. Opening it full size and zooming across the building, the walkthrough looks for anything written: a sign, a plaque, a logo. A company logo is visible in one of the windows. That name is the security answer; the reset form accepts it, and logging in with the new password confirms the takeover. (The video's auto-captions mishear the logo; the companion guide's solution names it correctly.) The order is worth copying: **question first, caption second, pixels last**. Knowing you need an employer's name tells you to look for text on a building, not at the trees or the sky. ## Was the photo's metadata the problem? No. The obvious first move on any photo challenge is to read its EXIF data for GPS coordinates. The manual walkthrough skips that step and goes straight to the pixels; HackerGPT's run at the end of the video does check, and reports that the image carries no EXIF or GPS metadata and is really a 2270 × 3022 PNG saved as `.jpg`. We re-ran the check ourselves. Here is what the Photo Wall file actually contains: ```bash curl -s -o photo.jpg "https://cybergym.hackergpt.app/assets/public/images/uploads/IMG_4253.jpg" curl -sI "https://cybergym.hackergpt.app/assets/public/images/uploads/IMG_4253.jpg" | grep -i content-type file photo.jpg ``` ```text Content-Type: image/jpeg photo.jpg: PNG image data, 2270 x 3022, 8-bit/color RGB, non-interlaced ``` The file is named `.jpg` and served as `image/jpeg`, but it is a PNG. Listing its chunks shows only `IHDR`, `sRGB`, `gAMA`, `pHYs`, `IDAT` and `IEND` — no `eXIf` chunk, so no EXIF, no GPS, no camera model. Whoever prepared it had already converted it and stripped the metadata. ![A Photo Wall image read in two layers: the file carries no EXIF, but the picture shows a workplace with a readable company logo](https://hackergpt.org/blog/photo-geolocation-osint-ctf/two-layers.webp) *The same upload read twice. The file layer was clean; the picture layer held the answer.* That is the lesson of the challenge in one result: **the metadata was clean and the photo still gave the answer away.** Scrubbing EXIF is necessary, but it only covers one of the two layers. ## How did HackerGPT solve it? After the manual walkthrough, the video hands the same challenge to HackerGPT in [CTF Mode](https://hackergpt.org/features/ctf-mode/) (from about 11:06), with the challenge text and its hint pasted into the chat. Its write-up covers the same steps in a different order, through the API instead of the UI: 1. **Found Emma's upload.** It queried the API behind the Photo Wall, `GET /rest/memories`, and filtered the list for the entry captioned "My old workplace..." from the user `E=ma²`, whose email is `emma@juice-sh.op`. 2. **Read the file, then the picture.** It reported no EXIF or GPS metadata, checked with ExifTool, and that the file is a PNG under a `.jpg` name. It then read the company logo off the building. 3. **Fetched the security question** from `GET /rest/user/security-question`, noting that the endpoint needs no authentication. 4. **Reset the password** with `POST /rest/user/reset-password`, which returned `200 OK`, then logged in with the new password through `POST /rest/user/login` to confirm the account was taken over. 5. **Confirmed the solve.** It checked `GET /api/Challenges/?name=Visual Geo Stalking` for `"solved": true` and saved the reset request in the Payloads tab so it can be replayed. The run ends with a session score table listing Visual Geo Stalking as the fifth Sensitive Data Exposure challenge solved in that session. If you want to see how reading a target carefully before acting generalises beyond photos, [mapping a web app's attack surface](https://hackergpt.org/blog/map-web-app-attack-surface/) applies the same read-first habit to an application, and [intelligence gathering](https://hackergpt.org/blog/intelligence-gathering/) covers OSINT more broadly. The [CTF Mode field guide](https://hackergpt.org/docs/ctf/) shows a full CTF Mode run step by step. ## How do I check my own photos before posting? Check both layers, every time, and remember that the caption counts as part of the photo. **The file layer:** - Turn off location tagging in your phone's camera settings if you do not need it, and use your platform's option to remove location when sharing. - Before posting from a computer, inspect the file with a metadata viewer and strip what you do not want to publish. - Do not assume a platform strips metadata for you; check what the file you actually upload contains. **The picture layer:** - Scan the frame for text: company names, logos, badges, street signs, house numbers, licence plates, screens and documents. - Look at the background, not just the subject. Windows, reflections and distinctive buildings narrow a location quickly. - Read your caption as an attacker would. "My old workplace", "first day at…", "my childhood street" turn an ordinary photo into the answer to a common security question. And fix the other half of the problem: if a site asks "first employer" or "first street" as a recovery question, do not answer truthfully. Store a random value in your password manager instead, and prefer a real second factor. The [OWASP Choosing and Using Security Questions Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Choosing_and_Using_Security_Questions_Cheat_Sheet.html) warns that such questions are no longer an acceptable authentication factor under NIST SP 800-63, and [NIST SP 800-63B](https://pages.nist.gov/800-63-4/sp800-63b.html) says verifiers "SHALL NOT prompt subscribers to use knowledge-based authentication (KBA)". ## Key takeaways - A photo leaks through its file metadata and through what it shows; check both before posting. - Start a photo OSINT challenge from the question you must answer, then the caption, then the pixels — it tells you what kind of detail to look for. - Clean EXIF is not a clean photo: in this challenge the file had no metadata and still gave up the answer. - Captions and backgrounds connect a picture to a person and a place; read yours as a stranger would. - Never use truthful answers to history-based security questions; store random values and use a real second factor. ## FAQ ### What is visual geolocation in OSINT? It is identifying where a photo was taken, or what it reveals, from its visible content: signs, logos, architecture, landmarks and text in the frame. It complements metadata analysis, which reads GPS and camera details from the file. Practise it on legal targets such as CyberGym's photo challenges, and use it to audit your own pictures. ### Does removing EXIF data make a photo safe to post? Not on its own. Removing EXIF takes out embedded GPS coordinates and camera details, but it does nothing about what the image shows. In this challenge the file had no metadata at all, and a logo in a window still answered the security question. ### What is the difference between Visual Geo Stalking and Meta Geo Stalking? Both are OWASP Juice Shop challenges that recover a security answer from a Photo Wall upload. Meta Geo Stalking is solved by reading the image's metadata; Visual Geo Stalking is solved by inspecting what the picture shows. Together they cover the two layers every photo has. ### Is it legal to practise photo OSINT on CyberGym? Yes. CyberGym is a deliberately vulnerable OWASP Juice Shop instance published for practice, and its users are fictional characters. Geolocating real people's photos is a different matter; keep the technique to practice targets and your own content. ## Sources - [OWASP Juice Shop companion guide — Sensitive Data Exposure](https://pwning.owasp-juice.shop/companion-guide/latest/part2/sensitive-data-exposure.html) - [OWASP Juice Shop project](https://owasp.org/www-project-juice-shop/) - [OWASP Choosing and Using Security Questions Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Choosing_and_Using_Security_Questions_Cheat_Sheet.html) - [NIST SP 800-63B — Digital Identity Guidelines, Authentication](https://pages.nist.gov/800-63-4/sp800-63b.html) Practise on [CyberGym](https://cybergym.hackergpt.app), then check your own photos the same way.