Audio Spectrograms
Find flags hidden in audio file spectrograms using Audacity, Sonic Visualiser, and Python.
Audio Spectrograms
Spectrogram steganography hides data (text, images, flags) in the frequency-time representation of an audio file. The flag is visually encoded in the spectrogram — invisible on a waveform view but clearly visible when displayed as a frequency plot. This is the most common hiding place in beginner audio CTF challenges.
How Spectrograms Work
A spectrogram plots: X axis = Time, Y axis = Frequency, Color/brightness = Amplitude. By adding tones at specific frequencies and times, you can "draw" text in the spectrogram that is invisible to casual listening.
Step-by-Step Analysis
Basic file checks first
file suspicious.wav
exiftool suspicious.wav
strings suspicious.wav | head -30
binwalk suspicious.wav # embedded files?
binwalk -e suspicious.wav # extract if foundOpen spectrogram in Audacity
- File → Import → Audio → select file
- In the track header (left side), click the dropdown arrow
- Select Spectrogram
- Press
Ctrl+Shift+E→ set window size to2048or4096 - Look for visible text or images in the display
The flag is often clearly readable in the high-frequency range.
Try Sonic Visualiser for higher resolution
sudo apt install sonic-visualiser- Open the file → Layer → Add Spectrogram
- Right panel: Colour →
White on Black(higher contrast) - Increase Window to
8192for fine frequency detail - Switch Scale between
LinearandLogarithmic
Check stereo channels separately
from scipy.io import wavfile
sample_rate, data = wavfile.read('suspicious.wav')
left = data[:, 0]
right = data[:, 1]
# Plot spectrogram of each channel separatelyViewing Tools
sudo apt install audacity- File → Import → Audio
- Dropdown on track → Spectrogram
Ctrl+Shift+E→ window size2048or4096- Zoom in on the frequency axis if needed
- Look in the 1000–8000 Hz range for text
Common CTF Variations
Checklist
-
file+exiftool+strings+binwalk - Open in Audacity → switch to Spectrogram view
- Adjust window size (try 1024, 2048, 4096)
- Sonic Visualiser for higher resolution
- Check each stereo channel independently
- Listen for DTMF (phone tones), Morse code, or SSTV noise
-
steghide extract -sf file.wav— sometimes applicable - Check metadata for hidden messages
Last updated on