2026-10-20

Announcing Image Location Scanner and Privacy Scanner version 1.3, a security plug-in for Burp and ZAP penetration testing tools. Privacy leaks from drones are now discovered, including proprietary DJI data; so you can show your CEO that his aerial company blog photos of the secret leadership off-site camping spot aren’t really secret. Version v1.3 also adds privacy leak detection from more obscure cameras along with faster image processing. Find the plug-in in Burp’s BAppStore or ZAP’s Marketplace to gain the latest functionality and features.

ILS passively scans for location and other privacy-related exposures in images during normal security assessments of websites via plug-ins for both Burp & ZAP. It assists in situations where end users may post profile images and possibly give away their home location, e.g. a dating site or children’s chatroom. More information on this topic, including a white paper based on a real-world site audit given as a presentation at the NYC+NJ chapters of the OWASP organization, can be found at www.veggiespam.com/ils. For sample images with embedded camera serial numbers or other privacy leaks, see the GitHub Project Page.

ILS finds privacy leakage in Exif, IPTC, XMP, and proprietary camera “Makernotes” tags; then flags the findings in Burp Scanner or ZAP Alerts as an information message. It would be up to the auditor to determine if location exposure is truly a security risk based on context.

Download today and enhance your security testing.