⚔️ ExifBlade

Malicious Metadata Generator & EXIF Forensics Tool
For authorized penetration testing and red team operations only.

 ███████╗██╗  ██╗██╗███████╗██████╗ ██╗      █████╗ ██████╗ ███████╗
 ██╔════╝╚██╗██╔╝██║██╔════╝██╔══██╗██║     ██╔══██╗██╔══██╗██╔════╝
 █████╗   ╚███╔╝ ██║█████╗  ██████╔╝██║     ███████║██║  ██║█████╗  
 ██╔══╝   ██╔██╗ ██║██╔══╝  ██╔══██╗██║     ██╔══██║██║  ██║██╔══╝  
 ███████╗██╔╝ ██╗██║██║     ██████╔╝███████╗██║  ██║██████╔╝███████╗
 ╚══════╝╚═╝  ╚═╝╚═╝╚═╝     ╚═════╝ ╚══════╝╚═╝  ╚═╝╚═════╝ ╚══════╝

---

🔍 What is ExifBlade?

ExifBlade is a command-line tool for metadata forensics and EXIF injection testing. It has two main purposes:

1. Red Team / Offensive — Generate files with weaponized metadata (XSS, SQLi, SSTI, XXE, LFI, RFI payloads) to test if web applications improperly process file metadata.
2. Blue Team / Forensics — Extract and deep-scan metadata from files to detect hidden or suspicious embedded content.

Supported File Types

Format	Extract	Inject	Wipe	Generate
JPG/JPEG	✅	✅	✅	✅
PNG	✅	✅	✅	✅
PDF	✅	—	✅	✅
DOCX	✅	—	✅	✅
MP3	✅	—	—	✅

---

⚡ Installation

git clone https://github.com/incrediblehacker/exifblade
cd exifblade
pip install -r requirements.txt

---

🚀 Usage

1. Extract Metadata

Extract all hidden metadata from any file:

# Standard scan
python exifblade.py extract -f photo.jpg

# Deep scan (detects JS, macros, external links, suspicious patterns)
python exifblade.py extract -f document.pdf --deep

# Save output to file
python exifblade.py extract -f photo.jpg --out results.txt

# JSON output
python exifblade.py extract -f photo.jpg --json

What it detects:

• GPS coordinates (real-world location)
• Author, device, software information
• Hidden timestamps and creation dates
• Embedded XSS / SQLi / SSTI / XXE patterns (auto-flagged 🚨)
• Embedded JavaScript in PDFs
• Macros and VBA content in DOCX files
• External link references in Office documents

---

2. Inject Payloads

Inject attack payloads into image metadata fields:

# Inject XSS payload
python exifblade.py inject -f photo.jpg --xss

# Inject SQLi payload
python exifblade.py inject -f photo.jpg --sqli

# Inject SSTI payload
python exifblade.py inject -f photo.jpg --ssti

# Inject XXE payload
python exifblade.py inject -f photo.jpg --xxe

# Custom payload into specific field
python exifblade.py inject -f photo.jpg --payload "<script>alert(1)</script>" --field Comment

# Spoof metadata (author, software, GPS, date)
python exifblade.py inject -f photo.jpg --author "John Smith" --software "iPhone 14" --gps --lat 51.5074 --lon -0.1278 --date "2020:06:15 09:30:00"

# Combine multiple payloads + spoofing
python exifblade.py inject -f photo.jpg --xss --sqli --gps --author "admin" -o evil_output.jpg

Available EXIF fields for injection: Comment, Artist, Copyright, Software, Make, Model, Description

---

3. Wipe Metadata

Strip all metadata from a file (anonymization):

python exifblade.py wipe -f photo.jpg
python exifblade.py wipe -f photo.jpg -o clean_photo.jpg
python exifblade.py wipe -f document.docx -o clean_doc.docx

---

4. Generate Weaponized Files

Create test files with pre-embedded payloads:

# Generate JPG with all payload types
python exifblade.py generate --type jpg --payload all --out evil.jpg

# Generate PDF with XSS payloads
python exifblade.py generate --type pdf --payload xss --out evil.pdf

# Generate DOCX with SQLi payloads
python exifblade.py generate --type docx --payload sqli --out evil.docx

# Generate MP3 with SSTI payloads
python exifblade.py generate --type mp3 --payload ssti --out evil.mp3

# Custom payload
python exifblade.py generate --type jpg --custom "{{7*7}}" --out ssti_test.jpg

Available payload types: xss, xxe, sqli, ssti, cmd, lfi, rfi, all

---

🎯 Real-World Attack Scenarios

Scenario 1: Testing Image Upload XSS

Many web apps display EXIF data (author name, camera model) without sanitization.

# Generate weaponized image
python exifblade.py generate --type jpg --payload xss --out test_upload.jpg

# Upload to target, check if XSS fires when app displays metadata

Scenario 2: OSINT / Forensics on Suspicious File

# Deep scan to find hidden info, GPS, suspicious strings
python exifblade.py extract -f suspicious.jpg --deep --json --out report.json

Scenario 3: Evidence Tampering Simulation

# Spoof timestamps and GPS on image (authorized forensics lab testing only)
python exifblade.py inject -f evidence.jpg --date "2019:03:21 14:22:00" --gps --lat 40.7128 --lon -74.0060

Scenario 4: PDF Metadata Exfil Test

python exifblade.py generate --type pdf --payload all --out test.pdf
python exifblade.py extract -f test.pdf --deep

---

🛡️ Detection Signatures (Blue Team)

ExifBlade's --deep flag auto-flags these patterns in metadata:

Category	Patterns Detected
XSS	<script>, onerror=, javascript:, svg onload
SQLi	OR '1'='1, UNION SELECT, DROP TABLE
SSTI	{{, }}, ${, <%= %>
XXE	<!ENTITY, SYSTEM, file:///
LFI	../, ..\\, /etc/passwd
CMD	|whoami, ;id;, `id`
Post-Ex	powershell, base64, exec(

---

📁 Project Structure

exifblade/
├── exifblade/            # Main package
│   ├── core/             # Modular logic (extractor, injector, etc.)
│   ├── cli.py            # Click-based CLI entry point
│   ├── engine.py         # Central orchestrator
│   ├── formatters.py     # Rich terminal output styling
│   ├── menu.py           # Interactive TUI menu
│   └── models.py         # Data models (dataclasses)
├── install.sh            # Global installation script
├── main.py               # Root entry point
├── pyproject.toml        # Modern packaging & dependencies
└── README.md

---

⚠️ Legal Disclaimer

ExifBlade is developed for authorized penetration testing, CTF challenges, and security research only.
Unauthorized use against systems you do not own or have explicit permission to test is illegal.
The author is not responsible for any misuse of this tool.

---

👤 Author

0xfaizan — github.com/incrediblehacker
Ethical Hacking | Red Team | AI Security

---

📄 License

MIT License — see LICENSE