Steganography
Index of all steganography pages - image, audio, file, and text-based data hiding techniques.
Steganography
Steganography is the art of hiding data in plain sight. Unlike encryption, which makes data unreadable, steganography hides data inside innocent-looking files (images, audio, text) so that no one suspects there's a secret at all. In CTFs, stego challenges give you a file and ask you to find the flag hidden somewhere inside it.
The key difference from forensics: forensics examines what happened (logs, memory, network traffic), while steganography asks "what's hidden inside this file that looks normal?"
Pages in This Section
Image Steganography
| Page | Difficulty | What You'll Learn |
|---|---|---|
| LSB Steganography | Beginner | Extract data hidden in the least significant bits of pixels |
| PNG Analysis | Intermediate | PNG chunk structure, data after IEND, dimension tricks |
| JPEG Analysis | Beginner | steghide, data after EOF, EXIF metadata hiding |
| Pixel Manipulation | Intermediate | Channel XOR, alpha hiding, palette tricks, image diff |
Audio Steganography
| Page | Difficulty | What You'll Learn |
|---|---|---|
| Spectrograms | Beginner | Visual data hidden in frequency-time plots |
| MP3 Steganography | Beginner | mp3stego, ID3 tags, DeepSound, frame analysis |
File Steganography
| Page | Difficulty | What You'll Learn |
|---|---|---|
| File Magic Bytes | Beginner | Identify corrupted headers, fix magic bytes, detect polyglots |
| Polyglot Files | Intermediate | Files valid in two formats simultaneously (PNG+ZIP, etc.) |
Text Steganography
| Page | Difficulty | What You'll Learn |
|---|---|---|
| Whitespace Steganography | Beginner | SNOW, tab/space encoding, zero-width characters |
| Unicode Steganography | Intermediate | Homoglyphs, variation selectors, invisible Unicode |
The Universal First Step
Before running any specialized steg tool, do this on every challenge file:
file suspicious_file # what is it really?
exiftool suspicious_file # metadata (Comment field hides flags)
strings suspicious_file | grep -iE "(flag|ctf|key|secret)" # quick win
binwalk suspicious_file # embedded files?This takes 10 seconds and solves a surprising number of stego challenges. The flag is often in a metadata comment, an embedded archive, or as plaintext in the binary.
Aperisolve (aperisolve.com) is the fastest starting point for any image challenge. Upload the image and it runs zsteg, strings, binwalk, exiftool, and bit plane analysis automatically.
Detection Workflow
Learning Path
Beginner: Start Here
- File Magic Bytes: Every file has magic bytes. Learn to identify, fix, and exploit them.
- JPEG Analysis: steghide, EXIF metadata, data after EOF. The most common stego challenge type.
- LSB Steganography: The foundational image technique. Learn zsteg, Stegsolve, and manual Python extraction.
- Spectrograms: Visual data hidden in audio. Open Audacity, switch to spectrogram view.
- Whitespace Steganography: SNOW, tab/space encoding, zero-width Unicode.
Intermediate: Deeper Analysis
- PNG Analysis: PNG chunk structure, IHDR dimension tricks, CRC brute-forcing.
- Pixel Manipulation: Channel XOR, alpha hiding, palette tricks, image diff.
- MP3 Steganography: mp3stego, DeepSound, ID3 tag hiding.
- Polyglot Files: Files that are valid in two formats at once.
- Unicode Steganography: Homoglyphs, variation selectors, invisible characters.
Steg by File Type
exiftool image.png # metadata
binwalk -e image.png # embedded files
zsteg image.png # LSB scan (PNG/BMP)
zsteg -a image.png # all LSB combinations
steghide extract -sf image.jpg -p "" # JPEG steghide (blank password)
stegseek image.jpg rockyou.txt # crack steghide password
# java -jar Stegsolve.jar # visual bit plane analysisTool Quick Reference
Last updated on
LLM Agent Exploitation
Attack tool-using LLM agents: tool and function-call abuse, SSRF/file-read/RCE via agent tools, excessive agency, the confused-deputy pattern, plugin and MCP abuse, and the sandbox-escape mindset.
LSB Steganography
Understand and extract data hidden via Least Significant Bit (LSB) manipulation in image files.