CTFlearn - 07601

https://beta.ctflearn.com/problems/97
Forensics 
by alexkato29



1) Download the image and vi the AGT.png. you will find the header JFIF which stands for stands for JPEG File Interchange Format.

$ vi AGT.png

2) Used strings to check the image AGT.png, you will get the following result. It looks like a zip instead of JPEG file

$ strings AGT.png

3) Used binwalk to inspect AGT.png. This is what I got.

$ binwalk AGT.png

4) Extract the file 

 $ binwalk -e AGT.png

5) Follow the tips, find the image file "I warned You.jpeg" 

 Secret Stuff.../Don't Open This.../I Warned You.jpegUX

6) Used strings the image and you will find the flag

CTFlearn FORENSICS 101

https://beta.ctflearn.com/problems/96


The image contains the flag string, you can just open the image using any editor and read line by line to find the flag. 

But there is a smart way using the "strings" command