Finding Flags in SVG/XML Files — A Beginner Forensics Approach

SVG files are often underestimated in CTF forensics. At first glance, they look like simple images, but under the surface they are actually structured text files written in XML. This makes them a common hiding place for flags and encoded data in beginner and intermediate challenges.

Understanding SVG and XML

An SVG (Scalable Vector Graphics) file is not a traditional image format. Instead, it is built using XML (Extensible Markup Language), which is a text-based format designed to store structured data.

Because of this structure:

• SVG files can be opened in any text editor
• Every visual element is defined using tags
• Text, shapes, and metadata are all stored as readable content

This is important in forensics because anything readable can potentially hide information.

Why SVG Files Are Used in CTF Forensics

CTF organizers often use SVG files because they allow multiple hiding techniques:

• Hidden text inside XML tags
• Comments that are not displayed visually
• Encoded data (Base64, Hex, etc.)
• Invisible elements using CSS styles
• Embedded files or images inside the SVG structure

Unlike binary image formats, SVG files are easy to manipulate and inspect, making them ideal for hiding challenges.

How Beginners Can Approach SVG Forensics

When a beginner encounters an SVG file in a CTF, the correct approach is to treat it as a text file first, not an image.

1. Open the file directly

The first step is always to open the file in a text editor. This immediately reveals the XML structure.

You may find elements like:

<text>flag{example}</text>

or hidden comments:

<!-- flag{hidden_data} -->

2. Search for keywords

Using simple tools can speed up discovery:

• Search for “flag”
• Look for suspicious strings
• Identify encoded text

Even basic commands like strings can reveal hidden content quickly.

3. Check for encoded data

CTF creators often hide flags using encoding methods such as ROT13, Base64.

Example:

<text>ZmxhZ3tzdmdfaGlkZGVufQ==</text>

This must be decoded using tools like CyberChef or any other decoder.

4. Look for invisible elements

SVG supports styling attributes that can hide content:

• display="none"
• opacity="0"
• Very small font sizes
• Off-screen coordinates

These elements may contain the flag but will not appear visually when the image is opened normally.