OSINT from images' metadata hosted on websites

What it is

A reconnaissance technique for red teams: extracting personally identifying and system-fingerprinting metadata from images that companies host on their public websites (team pages, article illustrations) but never stripped. ExifTool is the named extraction tool, and its field-name conventions are used throughout. Worked examples come from a Le Monde (www.lemonde.fr) image, revealing a photographer named Cyril, his email, that the photo was taken in Paris, and that he edited it in Photoshop 10.4 on a Macintosh.

How it works

Cameras and editing software auto-populate metadata; upload workflows often pass images through "as-is." The article groups fields of interest by intelligence value — the concrete field names are the payload the summary omits:

• Names: XMP:Author, XMP:Creator, EXIF:Artist, XMP:Source, IPTC:Source, IPTC:Writer-Editor, IPTC:By-line; also copyright fields EXIF:Copyright, IPTC:CopyrightNotice, IPTC:Credit, XMP:Credit.
• Email: XMP:CreatorWorkEmail (or copyright fields) — useful even when it only reveals the domain or firstname.lastname convention.
• Phone: XMP:CreatorWorkTelephone (rarely populated).
• Creator address: XMP:CreatorAddress, CreatorCity, CreatorCountry, CreatorPostalCode, CreatorRegion. Photo location: IPTC:City, Province-State, Country-PrimaryLocationName, Sub-location.
• GPS: EXIF:GPSLatitude, GPSLongitude, GPSAltitude (+ Ref fields).
• Software/platform (most commonly present, drives exploit targeting): XMP:CreatorTool, XMP:Platform, XMP:HistorySoftwareAgent, EXIF:Software, IPTC:OriginatingProgram.
• Dates: file/ICC/PNG/XMP/IPTC create and modify timestamps (e.g. XMP:CreateDate, IPTC:DateCreated).
• Free-text that often leaks names and locations of people in the scene: EXIF:ImageDescription, EXIF:UserComment, IPTC:Caption-Abstract, IPTC:Headline, IPTC:Keywords, IPTC:SpecialInstructions.

What to do

Offensively, the page previews (but cuts off before delivering) automation to scrape all images from a page and bulk-extract metadata. Defensively, the same field lists are the strip-list: run images through ExifTool to clear these fields before publishing, paying particular attention to software/platform tags (exploit fingerprinting) and free-text IPTC fields (which name uninvolved third parties — the Le Monde caption named political figures at a Matignon scene).

Caveats

No commands or automation script are given — the "Automatisation" section is truncated mid-sentence in the captured text. Phone and GPS fields are noted as usually empty. The author states the field list is incomplete and growing as they test more sites, so treat it as a starting set rather than exhaustive.