LSB Steganography

LSB (Least Significant Bit) steganography hides data in the lowest bit of each color channel in an image. Since changing a pixel value from 254 to 255 produces no visible color difference, the hidden data is invisible to the human eye. This is the most common image steganography technique in CTFs.

How LSB Works

Each pixel in an RGB image has three channels: Red, Green, Blue — each an 8-bit value (0–255). The least significant bit (bit 0) contributes the least to the visible color.

Original Red value:  11001010  (202)
After hiding '1':    11001011  (203)  ← changes by just 1
After hiding '0':    11001010  (202)  ← unchanged

To hide a message, each character's binary representation is spread across the LSBs of sequential pixels. The image looks identical, but the LSBs encode your data.

Bit-Plane Overview

Step-by-Step Analysis

file suspicious.png
exiftool suspicious.png

strings suspicious.png | grep -iE "(flag|ctf|key|pass|secret)"

binwalk suspicious.png
binwalk -e suspicious.png

zsteg suspicious.png         # fastest for PNG
zsteg -a suspicious.png      # try ALL combinations

Tool: zsteg (PNG and BMP)

zsteg is the go-to tool for automated LSB scanning of PNG files:

gem install zsteg

zsteg suspicious.png              # basic scan
zsteg -a suspicious.png           # try ALL combinations
zsteg -E "b1,rgb,lsb,xy" suspicious.png > extracted.bin   # specific config
zsteg -E "b1,r,lsb,xy" suspicious.png                     # red channel only
zsteg -E "b2,rgb,lsb,xy" suspicious.png                   # 2 LSBs
zsteg -E "b1,bgr,lsb,xy" suspicious.png                   # reversed channel order

Reading zsteg output:

b1,rgb,lsb,xy       .. text: "flag{lsb_1s_fun}"
                    ↑   ↑      ↑ hidden content
                    bit channel scan pattern

Tool: steghide (JPEG and WAV)

steghide uses a different algorithm (not simple LSB) for JPEG files:

steghide extract -sf suspicious.jpg -p ""          # blank password first
steghide extract -sf suspicious.jpg -p "password"  # known password
steghide info suspicious.jpg                       # check if data embedded

# Crack password
stegseek suspicious.jpg /usr/share/wordlists/rockyou.txt

Tool: Stegsolve (GUI)

Stegsolve lets you visually flip through each individual bit plane:

wget http://www.caesum.com/handbook/Stegsolve.jar
java -jar Stegsolve.jar

1. File → Open → select image
2. Click left/right arrows to cycle through bit planes
3. Analyse → Data Extract → configure custom LSB extraction (channels, bit positions, scan order)

Manual Python Extraction

from PIL import Image

img = Image.open("suspicious.png")
pixels = list(img.getdata())

bits = ""
for px in pixels:
    bits += str(px[0] & 1)   # LSB of red channel

message = ""
for i in range(0, len(bits), 8):
    byte = bits[i:i+8]
    if len(byte) == 8:
        char_val = int(byte, 2)
        if char_val == 0:
            break
        if 32 <= char_val <= 126:
            message += chr(char_val)

print(f"Message: {message}")

Online Tools

Checklist

• file + exiftool + strings → basic identification
• binwalk -e → embedded files?
• zsteg suspicious.png → automated LSB scan
• zsteg -a suspicious.png → try ALL combinations
• steghide extract -sf suspicious.jpg -p "" → blank password
• stegseek suspicious.jpg rockyou.txt → crack steghide password
• Open in Stegsolve → browse bit planes visually
• Upload to Aperisolve → automated multi-tool analysis
• Python extraction → try all channel/bit combinations manually
• Check alpha channel (RGBA) separately
• Try column-order scanning (not just row-order)
• Look for 2-bit or 3-bit LSB hiding

Last updated on Aug 1, 2025