Challenge Overview
A PDF file containing apparently meaningless content, with the flag hidden in the document's Author metadata field — encoded in Base64. PDF metadata fields (Author, Title, Subject, Keywords, Producer) are a common location for hidden data in forensics challenges.
Extraction
pdfinfo confidential.pdf
# Output:
Author: cGljb0NURntwdXp6bDNkX20zdGFkYXRhX2YwdW5kIV8wZTJkZTVhMX0=
Producer: PyPDF2
Pages: 1
echo "cGljb0NURntwdXp6bDNkX20zdGFkYXRhX2YwdW5kIV8wZTJkZTVhMX0=" | base64 -d
# picoCTF{puzzl3d_m3tadata_f0und!_0e2de5a1}PDF Metadata Forensics Checklist
| Tool | Command | What to check |
|---|---|---|
pdfinfo | pdfinfo file.pdf | Author, Title, Subject, Keywords, Producer, Creator |
exiftool | exiftool file.pdf | All metadata including embedded XMP |
strings | strings file.pdf | grep pico | Plain-text strings anywhere in the binary |
binwalk | binwalk -e file.pdf | Embedded files, additional data streams |
Key Insight: Always run
exiftool and pdfinfo as the first step on any document forensics challenge before opening the file visually. Metadata fields are invisible to normal document viewers but trivially readable with command-line tools — and frequently used to hide data in CTFs.