JPEG Analysis
Analyze JPEG files for hidden data - steghide, EXIF, quantization tables, and embedded content.
JPEG Analysis
JPEG is the most common image format in CTF steganography challenges. It uses lossy compression and a rich metadata structure that provides many hiding places. The most common technique is steghide, but don't forget to check for data after the end-of-image marker, embedded files, and EXIF metadata.
JPEG File Structure
Data hidden after FF D9 (EOI) is a very common CTF technique. Always check for bytes beyond the end-of-image marker.
Systematic Analysis
Identify and check metadata
file suspicious.jpg
exiftool suspicious.jpg
# Key fields: Comment, Artist, Description, GPS, UserCommentSearch for strings
strings suspicious.jpg | grep -iE "(flag|ctf|key|secret)"Hex inspection: check magic and EOF
xxd suspicious.jpg | head -5 # Should start: FF D8 FF
xxd suspicious.jpg | tail -5 # Should end: FF D9Check for data after JPEG EOF
data = open('suspicious.jpg','rb').read()
eof = data.rfind(b'\xff\xd9')
extra = data[eof+2:]
if extra:
print(f'Data after JPEG EOF: {len(extra)} bytes')
open('after_eof.bin','wb').write(extra)Run steghide / stegseek
steghide extract -sf suspicious.jpg -p ""
stegseek suspicious.jpg /usr/share/wordlists/rockyou.txtCheck for embedded files with binwalk
binwalk suspicious.jpg
binwalk -e suspicious.jpgsteghide
steghide hides data in JPEG and WAV files using least-significant-bit techniques:
steghide extract -sf suspicious.jpg -p "" # blank password first
steghide extract -sf suspicious.jpg -p "password123" # known password
steghide info suspicious.jpg # check if data embeddedsteghide only works on JPEG and WAV, not PNG or BMP. For PNG use zsteg instead.
jsteg (DCT Coefficient Hiding)
jsteg hides data in JPEG DCT coefficients (least significant bits of quantized values):
go get github.com/lukechampine/jsteg
jsteg reveal suspicious.jpg output.txtJPEG Marker Reference
Online Tools
| Tool | URL | Purpose |
|---|---|---|
| Aperisolve | aperisolve.com | All-in-one automated scan |
| FotoForensics | fotoforensics.com | Error Level Analysis (ELA) that spots re-saved regions |
Checklist
-
exiftool→ check Comment, Artist, Description fields -
steghide extract -p ""→ blank password attempt -
stegseek+rockyou.txt→ password brute force -
strings | grep flag→ direct string search -
binwalk -e→ embedded files - Check for data after
FF D9(EOF marker) - Parse JPEG markers → check COM (comment) section
- FotoForensics → Error Level Analysis (ELA)
- Aperisolve → automated multi-tool scan
Last updated on