SteganographyText Steganography
Whitespace Steganography
steganographybeginner
Detect and decode data hidden in whitespace characters - spaces, tabs, and zero-width characters.
steganographywhitespacetabsspaceszero-widthunicodetext
Whitespace Steganography
Whitespace steganography hides data in the invisible characters of text files — trailing spaces, tab/space encoding, or zero-width Unicode characters. The text looks identical to the human eye, but the invisible bytes encode a hidden message.
Technique Overview
| Type | Method | Tool |
|---|---|---|
| SNOW | Trailing spaces/tabs encode bits | stegsnow |
| Tab/Space encoding | Tab=1, Space=0 (or reversed) | Python |
| Zero-width chars | U+200B, U+200C, U+200D | Python Unicode analysis |
| Indentation encoding | Indentation depth encodes bits | Custom |
Detection and Decoding
Make whitespace visible
cat -A suspicious.txt
# $ = end of line
# ^I = tab
# trailing spaces appear before $Try SNOW (most common tool)
sudo apt install stegsnow
stegsnow -C suspicious.txt # no password
stegsnow -C -p "password" suspicious.txt # with passwordDecode tab/space binary
def decode_whitespace(text):
binary = ''
for char in text:
if char == '\t':
binary += '1'
elif char == ' ':
binary += '0'
result = ''
for i in range(0, len(binary), 8):
byte = binary[i:i+8]
if len(byte) == 8:
result += chr(int(byte, 2))
return result
with open('suspicious.txt', 'r') as f:
print(decode_whitespace(f.read()))Also try the reversed encoding: Tab=0, Space=1.
Check for zero-width Unicode characters
def find_and_decode_zerowidth(text):
zw_chars = {
'\u200b': ('1', 'ZERO WIDTH SPACE'),
'\u200c': ('0', 'ZERO WIDTH NON-JOINER'),
'\u200d': ('?', 'ZERO WIDTH JOINER'),
'\ufeff': ('?', 'BOM'),
'\u2060': ('?', 'WORD JOINER'),
}
binary = ''
for i, char in enumerate(text):
if char in zw_chars:
bit, name = zw_chars[char]
print(f"Position {i}: {name} (U+{ord(char):04X})")
if bit in '01':
binary += bit
if binary:
chars = [chr(int(binary[i:i+8], 2)) for i in range(0, len(binary)-7, 8)]
print(f"Decoded: {''.join(chars)}")
with open('suspicious.txt', 'r', encoding='utf-8') as f:
find_and_decode_zerowidth(f.read())Tools
sudo apt install stegsnow
stegsnow -C suspicious.txt # reveal hidden message
stegsnow -C -p "password" suspicious.txt # with password
stegsnow -C -m "flag{hidden}" -p "secret" cover.txt steg.txt # hide messageZero-Width Characters
U+200B ZERO WIDTH SPACE
U+200C ZERO WIDTH NON-JOINER
U+200D ZERO WIDTH JOINER
U+FEFF BOM / ZERO WIDTH NO-BREAK SPACE
U+2060 WORD JOINER
U+00AD SOFT HYPHENCommon encoding: U+200B = 1, U+200C = 0 → binary → ASCII
Checklist
-
cat -A suspicious.txt→ visible whitespace markers -
stegsnow -C suspicious.txt→ SNOW decode - Python: Tab=1, Space=0 binary decode (and try reversed)
-
xxd | grep "20 0a"→ trailing spaces before newlines - Check for zero-width Unicode characters (U+200B, U+200C, U+200D)
- Count trailing spaces per line → may encode binary
Last updated on