JPEG Analysis
Analyze JPEG files for hidden data - steghide, EXIF, quantization tables, and embedded content.
JPEG Analysis
JPEG is the most common image format in CTF steganography challenges. It uses lossy compression and a rich metadata structure that provides many hiding places. The most common technique is steghide — but don't forget to check for data after the end-of-image marker, embedded files, and EXIF metadata.
JPEG File Structure
Data hidden after FF D9 (EOI) is a very common CTF technique. Always check for bytes beyond the end-of-image marker.
Systematic Analysis
Identify and check metadata
file suspicious.jpg
exiftool suspicious.jpg
# Key fields: Comment, Artist, Description, GPS, UserCommentSearch for strings
strings suspicious.jpg | grep -iE "(flag|ctf|key|secret)"Hex inspection — check magic and EOF
xxd suspicious.jpg | head -5 # Should start: FF D8 FF
xxd suspicious.jpg | tail -5 # Should end: FF D9Check for data after JPEG EOF
data = open('suspicious.jpg','rb').read()
eof = data.rfind(b'\xff\xd9')
extra = data[eof+2:]
if extra:
print(f'Data after JPEG EOF: {len(extra)} bytes')
open('after_eof.bin','wb').write(extra)Run steghide / stegseek
steghide extract -sf suspicious.jpg -p ""
stegseek suspicious.jpg /usr/share/wordlists/rockyou.txtCheck for embedded files with binwalk
binwalk suspicious.jpg
binwalk -e suspicious.jpgsteghide
steghide hides data in JPEG and WAV files using least-significant-bit techniques:
steghide extract -sf suspicious.jpg -p "" # blank password first
steghide extract -sf suspicious.jpg -p "password123" # known password
steghide info suspicious.jpg # check if data embeddedsteghide only works on JPEG and WAV — not PNG or BMP. For PNG use zsteg instead.
jsteg (DCT Coefficient Hiding)
jsteg hides data in JPEG DCT coefficients (least significant bits of quantized values):
go get github.com/lukechampine/jsteg
jsteg reveal suspicious.jpg output.txtJPEG Marker Reference
Online Tools
| Tool | URL | Purpose |
|---|---|---|
| Aperisolve | aperisolve.com | All-in-one automated scan |
| FotoForensics | fotoforensics.com | Error Level Analysis (ELA) — spots re-saved regions |
Checklist
-
exiftool→ check Comment, Artist, Description fields -
steghide extract -p ""→ blank password attempt -
stegseek+rockyou.txt→ password brute force -
strings | grep flag→ direct string search -
binwalk -e→ embedded files - Check for data after
FF D9(EOF marker) - Parse JPEG markers → check COM (comment) section
- FotoForensics → Error Level Analysis (ELA)
- Aperisolve → automated multi-tool scan
Last updated on