<commit_before># Image Location & Privacy Scanner

Passively scans for GPS location and other privacy-related exposures in images during normal
security assessments of websites via plug-ins for both Burp & ZAP.  Image
Location & Privacy Scanner (ILS) assists in situations where end users may post profile
images and possibly give away their home location, e.g. a dating site or
children's chatroom.

More information on this topic, including a white paper
based on a real-world site audit given as a presentation at the New
Jersey chapter of the OWASP organization, can be found at
[www.veggiespam.com/ils/](https://www.veggiespam.com/ils/).

This software finds the GPS information inside of Exif tags, IPTC codes,
and proprietary camera codes. Then, the Image Location & Privacy Scanner flags the
findings in the
Burp Scanner or ZAP Alerts list as an information message.  It would be
up to the auditor to determine if location exposure is truly a security
risk based on context.

Special thanks to my [contributors, listed here](CONTRIBUTORS.md).
Full version history can be found in the [CHANGELOG.md](CHANGELOG.md).

## Sample Run

<p><img width="50%" height="50%" src="img/screenshot-1-burp.png" align="right"/>
Configure the web browser to proxy through Burp or ZAP per the
instructions of those products.  Then, browse to a few sample sites to
see Alerts being raised:</p>

* MetaData Extractor's [SampleOutput page](https://github.com/drewnoakes/metadata-extractor/wiki/SampleOutput)
contains some good images.  But first, in order to view the URLs
below, you may need to obtain a GitHub session cookie first by going to
[MDE on GitHub](https://github.com/drewnoakes/metadata-extractor-images/tree/master/jpg).
    - [iPhone 4](https://raw.githubusercontent.com/drewnoakes/metadata-extractor-images/master/jpg/Apple%20iPhone%204.jpg)
    shows GPS data.
    - [FujiFilm FinePix S1 Pro](https://raw.githubusercontent.com/drewnoakes/metadata-extractor-images/master/jpg/FujiFilm%20FinePixS1Pro%20(1).jpg)
    has embedded IPTC locations and keywords.
    - [Panasonic DMC-TZ10](https://raw.githubusercontent.com/drewnoakes/metadata-extractor-images/master/jpg/Panasonic%20DMC-TZ10.jpg) shows proprietary Panasonic tags including city, state, country along
    with facial recognition information, like the name and age of the person in
    the picture.  Burp screen shot of this shown to the right and ZAP is
	shown below.
* This professional photographer leaves Exif & IPTC data in many photos: [Raia.com](https://raia.com/)

<p align="center"><img width="65%" height="65%"
src="img/screenshot-1-zap.png" align="center"/></p>

The ILS jar file contains a `main()` function, so it is possible to
directly run the scanner from the command line on local files.  The
classpath must contain the ILS jar file along with the supporting jars
for the MetaData Extractor and the Adobe XMP library.  To from the
command line, just do:

```
$ java ...
Java Image Location & Privacy Scanner
Usage: java ILS.class [-h|-t] file1.jpg file2.png file3.txt [...]
	-h : optional specifer to output results in HTML format
	-t : optional specifer to output results in plain text format (default)

# Run main() directly from the Burp jar packaging
java -classpath image-location-scanner-all.jar com.veggiespam.imagelocationscanner.ILS file1.jpg file2.png file3.tiff

# Example command line output
Processing Panasonic DMC-TZ10.jpg :
Location Exif_GPS: 53° 8' 49.65", 8° 10' 45.1"
Location Panasonic: City = OLDENBURG (OLDB.)
Location Panasonic: Country = GERMANY
Location Panasonic: State = OLDENBURG (OLDB.)

Privacy:: Panasonic: Face Recognition Info = Face 1: x: 142 y: 120 width: 76 height: 76 name: NIELS age: 31 years 7 months 15 days
Privacy Panasonic: Internal Serial Number = F541005110191

Processing Panasonic Lumix DMC-LX7.jpg :

Privacy Panasonic: Internal Serial Number = F111311090158

Processing j2.jpg : Location Exif_GPS: 40° 18' 54.92", -74° 39' 37.85"
```

Note the names of the jar files could be different, please confirm them.


# Usage Requirements
The Image Location & Privacy Scanner runs as both a Burp and ZAP plug-in.
The required versions of those packages are:

* Burp Pro, 1.4 or newer from
  [PortSwigger Burp web site](http://portswigger.net/burp/)
* ZAP, 2.7.x or newer from
  [OWASP ZAP web site](https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project)

## Burp Installation

Burp Application Store: Launch Burp and click Extender tab &rarr;
Bapp Store &rarr; left pane &rarr; Image Location & Privacy Scanner.  In the right window pane, the
version and description of the plug-in will be shown; click the Install<commit_msg>fixed up command line output to match new output<commit_after># Image Location & Privacy Scanner

Passively scans for GPS location and other privacy-related exposures in images during normal
security assessments of websites via plug-ins for both Burp & ZAP.  Image
Location & Privacy Scanner (ILS) assists in situations where end users may post profile
images and possibly give away their home location, e.g. a dating site or
children's chatroom.

More information on this topic, including a white paper
based on a real-world site audit given as a presentation at the New
Jersey chapter of the OWASP organization, can be found at
[www.veggiespam.com/ils/](https://www.veggiespam.com/ils/).

This software finds the GPS information inside of Exif tags, IPTC codes,
and proprietary camera codes. Then, the Image Location & Privacy Scanner flags the
findings in the
Burp Scanner or ZAP Alerts list as an information message.  It would be
up to the auditor to determine if location exposure is truly a security
risk based on context.

Special thanks to my [contributors, listed here](CONTRIBUTORS.md).
Full version history can be found in the [CHANGELOG.md](CHANGELOG.md).

## Sample Run

<p><img width="50%" height="50%" src="img/screenshot-1-burp.png" align="right"/>
Configure the web browser to proxy through Burp or ZAP per the
instructions of those products.  Then, browse to a few sample sites to
see Alerts being raised:</p>

* MetaData Extractor's [SampleOutput page](https://github.com/drewnoakes/metadata-extractor/wiki/SampleOutput)
contains some good images.  But first, in order to view the URLs
below, you may need to obtain a GitHub session cookie first by going to
[MDE on GitHub](https://github.com/drewnoakes/metadata-extractor-images/tree/master/jpg).
    - [iPhone 4](https://raw.githubusercontent.com/drewnoakes/metadata-extractor-images/master/jpg/Apple%20iPhone%204.jpg)
    shows GPS data.
    - [FujiFilm FinePix S1 Pro](https://raw.githubusercontent.com/drewnoakes/metadata-extractor-images/master/jpg/FujiFilm%20FinePixS1Pro%20(1).jpg)
    has embedded IPTC locations and keywords.
    - [Panasonic DMC-TZ10](https://raw.githubusercontent.com/drewnoakes/metadata-extractor-images/master/jpg/Panasonic%20DMC-TZ10.jpg) shows proprietary Panasonic tags including city, state, country along
    with facial recognition information, like the name and age of the person in
    the picture.  Burp screen shot of this shown to the right and ZAP is
	shown below.
* This professional photographer leaves Exif & IPTC data in many photos: [Raia.com](https://raia.com/)

<p align="center"><img width="65%" height="65%"
src="img/screenshot-1-zap.png" align="center"/></p>

The ILS jar file contains a `main()` function, so it is possible to
directly run the scanner from the command line on local files.  The
classpath must contain the ILS jar file along with the supporting jars
for the MetaData Extractor and the Adobe XMP library.  To from the
command line, just do:

```
$ java -classpath build/libs/image-location-scanner-all.jar   com.veggiespam.imagelocationscanner.ILS
Java Image Location & Privacy Scanner
Usage: java ILS.class [-h|-t] file1.jpg file2.png file3.txt [...]
	-h : optional specifier to output results in HTML format
	-t : optional specifier to output results in plain text format (default)

# Run main() directly from the Burp jar packaging
$ java -classpath build/libs/image-location-scanner-all.jar  com.veggiespam.imagelocationscanner.ILS file1.jpg file2.png file3.tiff

# Example command line output:
Processing Panasonic DMC-TZ10.jpg : Location:: Exif_GPS: 53° 8' 49.65", 8° 10' 45.1"
Panasonic: City = OLDENBURG (OLDB.)
Panasonic: Country = GERMANY
Panasonic: State = OLDENBURG (OLDB.)


Privacy:: Panasonic: Face Recognition Info = Face 1: x: 142 y: 120 width: 76 height: 76 name: NIELS age: 31 years 7 months 15 days
Panasonic: Internal Serial Number = F541005110191

Processing Panasonic Lumix DMC-LX7.jpg :

Privacy Panasonic: Internal Serial Number = F111311090158

Processing j2.jpg : Location Exif_GPS: 40° 18' 54.92", -74° 39' 37.85"
```

Note the names of the jar files could be different, please confirm them.


# Usage Requirements
The Image Location & Privacy Scanner runs as both a Burp and ZAP plug-in.
The required versions of those packages are:

* Burp Pro, 1.4 or newer from
  [PortSwigger Burp web site](http://portswigger.net/burp/)
* ZAP, 2.7.x or newer from
  [OWASP ZAP web site](https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project)

## Burp Installation

Burp Application Store: Launch Burp and click Extender tab &rarr;
Bapp Store &rarr; left pane &rarr; Image Location & Privacy Scanner.  In the right window pane, the
version and description of the plug-in will be shown; click the Install
{'fraction_non_alphanumeric': 0.08544740473410466, 'fraction_numerical': 0.023776669143403036, 'mean_word_length': 4.5067212156633545, 'pattern_counts': {'":': 0, '<': 15, '<?xml version=': 0, '>': 15, 'https://': 16, 'lorem ipsum': 0, 'www.': 6, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2509743', 'n_tokens_mistral': 3102, 'n_tokens_neox': 2831, 'n_words': 1160}