Intelligence: file, strings, exiftool - three teams before heavy artillery
The most expensive mistake in CTF steganography is to grab specialized tools without basic intelligence. Three minutes for initial analysis save thirty on the selection of a password or a selection of methods.
file – real file type
The expansion of forensic CTF tasks is lying regularly. File challenge.txt is a BMP picture, photo.jpg – ZIP archive, and data.bin – quite ordinary PNG. Team file challenge.txt determines the format by magic bytes - the first bytes of the file, unique for each format. JPEG begins with FF D8 FF, PNG — with 89 50 4E 47 (Symbols \x89PNG), ZIP – with 50 4B (PK).
It is important to read the whole conclusion file, not just the type. The field comment in JPEG, the value segment length, quantity components – everything can contain a hint or a password. In the analysis of the task picocTF Hidden in Plainsight (according to the description of the author of the decision on dev.to) conclusion file img.jpg showed in the field comment line c3RlZ2hpZGU6Y0VGNmVuZHZjbVE9 – base64, inside of which there was a direct indication of the steghide and the coded password. Most of the participants scrolled through the conclusion and missed the key to the decision.
Morality: Don't be lazy to read three lines of output in its entirety.
strings – search for hidden information in three seconds
Launching strings image.png | grep -i flag – three seconds, and on light tasks the flag is inscribed with open text after the marker of the end of the image. If the flag format is unknown, strings -n 8 image.png display lines from 8 characters long, cutting off binary noise.
Combination with grep expands the possibilities: strings file | grep -iE "flag|ctf|key|pass" He is looking for several patterns at once. Restriction: if the data is encoded (base64, hex, XOR), strings They won't find them.
exiftool – metadata as a stash
Team exiftool file.jpg pulls out the full set of metadata: GPS coordinates, author, editing program, comments, timestamps. In CTF, the flag is regularly hidden in the fields of Comment, Artist, Copyright or Description.
PNG does not formally support the EXIF standard, but stores metadata in text chanks tEXt, zTXt and iTXt Exiftool reads them without problems. Geolocation tasks (to determine the city by GPS coordinates from the metadata photo) are a separate subcategory, where exiftool is indispensable.
Only after these three steps move to specialized tools. Further order depends on the file format - and here system errors begin.
binwalk: extracting data from nested files
binwalk scans a binary file for signatures — headers of known formats (ZIP, RAR, PNG, gzip, ELF and dozens of others). Typical CTF scenario: the JPEG picture is finished by the ZIP archive after the end of the image marker (byte FF D9). The browser or viewer will show a regular photo, and the binwalk will see two files with their offsets.
Team binwalk challenge.jpg displays a list of the signals found. Flag -e automatically extracts detected files: binwalk -e challenge.jpg creates a directory _challenge.jpg.extracted with content.
The nuance that stumbles: binwalk recognizes titles, but does not verify the integrity of the objects found. False positives are common. The tool mistakes a random byte sequence as the beginning of the file. If the recovered object weighs several bytes or does not open, almost certainly a false positive. Do not believe every line in the conclusion.
The main advantage of binwalk is that it works with any format. JPEG, PNG, WAV, PDF, ELF-binary - without restrictions. But he's looking for nested files, not data hidden in pixels or audio samples. Therefore, binwalk and stego tools complement each other: the first finds attachments at the level of the file structure, the second - data encoded in the content.
Alternative for file carving – utility foremost, which recovers files by titles and footers. In practice, binwalk copes more often, but sometimes pulls out the files that binwalk missed. Keep both on hand.
steghide: how to use for JPEG and WAV
steghide is one of the most common tools for CTF steganography, but it has a strict limit on formats: only JPEG, BMP, WAV and AU are supported. Trying to feed him PNG will end in error. Remember this bundle – it will save time at every competition.
How Steghide hides data
For JPEG, stegide does not work with pixels directly, but with DCT coefficients (Discrete Cosine Transform) – numerical values that occur with JPEG compression. The algorithm rearranges the pairs of coefficients so that the statistical distribution of the image remains almost unchanged. That is why binwalk here is useless: there are no completed files, no extra signatures. Payload is woven into the compression structure itself, and it is impossible to detect it without the right tool.
For WAV steghide, it modifys the younger bits of audio samples. The human ear does not catch the difference, and the spectral analysis in Audacity usually does not show anomalies.
The most expensive mistake in CTF steganography is to grab specialized tools without basic intelligence. Three minutes for initial analysis save thirty on the selection of a password or a selection of methods.
file – real file type
The expansion of forensic CTF tasks is lying regularly. File challenge.txt is a BMP picture, photo.jpg – ZIP archive, and data.bin – quite ordinary PNG. Team file challenge.txt determines the format by magic bytes - the first bytes of the file, unique for each format. JPEG begins with FF D8 FF, PNG — with 89 50 4E 47 (Symbols \x89PNG), ZIP – with 50 4B (PK).
It is important to read the whole conclusion file, not just the type. The field comment in JPEG, the value segment length, quantity components – everything can contain a hint or a password. In the analysis of the task picocTF Hidden in Plainsight (according to the description of the author of the decision on dev.to) conclusion file img.jpg showed in the field comment line c3RlZ2hpZGU6Y0VGNmVuZHZjbVE9 – base64, inside of which there was a direct indication of the steghide and the coded password. Most of the participants scrolled through the conclusion and missed the key to the decision.
Morality: Don't be lazy to read three lines of output in its entirety.
strings – search for hidden information in three seconds
Launching strings image.png | grep -i flag – three seconds, and on light tasks the flag is inscribed with open text after the marker of the end of the image. If the flag format is unknown, strings -n 8 image.png display lines from 8 characters long, cutting off binary noise.
Combination with grep expands the possibilities: strings file | grep -iE "flag|ctf|key|pass" He is looking for several patterns at once. Restriction: if the data is encoded (base64, hex, XOR), strings They won't find them.
exiftool – metadata as a stash
Team exiftool file.jpg pulls out the full set of metadata: GPS coordinates, author, editing program, comments, timestamps. In CTF, the flag is regularly hidden in the fields of Comment, Artist, Copyright or Description.
PNG does not formally support the EXIF standard, but stores metadata in text chanks tEXt, zTXt and iTXt Exiftool reads them without problems. Geolocation tasks (to determine the city by GPS coordinates from the metadata photo) are a separate subcategory, where exiftool is indispensable.
Only after these three steps move to specialized tools. Further order depends on the file format - and here system errors begin.
binwalk: extracting data from nested files
binwalk scans a binary file for signatures — headers of known formats (ZIP, RAR, PNG, gzip, ELF and dozens of others). Typical CTF scenario: the JPEG picture is finished by the ZIP archive after the end of the image marker (byte FF D9). The browser or viewer will show a regular photo, and the binwalk will see two files with their offsets.
Team binwalk challenge.jpg displays a list of the signals found. Flag -e automatically extracts detected files: binwalk -e challenge.jpg creates a directory _challenge.jpg.extracted with content.
The nuance that stumbles: binwalk recognizes titles, but does not verify the integrity of the objects found. False positives are common. The tool mistakes a random byte sequence as the beginning of the file. If the recovered object weighs several bytes or does not open, almost certainly a false positive. Do not believe every line in the conclusion.
The main advantage of binwalk is that it works with any format. JPEG, PNG, WAV, PDF, ELF-binary - without restrictions. But he's looking for nested files, not data hidden in pixels or audio samples. Therefore, binwalk and stego tools complement each other: the first finds attachments at the level of the file structure, the second - data encoded in the content.
Alternative for file carving – utility foremost, which recovers files by titles and footers. In practice, binwalk copes more often, but sometimes pulls out the files that binwalk missed. Keep both on hand.
steghide: how to use for JPEG and WAV
steghide is one of the most common tools for CTF steganography, but it has a strict limit on formats: only JPEG, BMP, WAV and AU are supported. Trying to feed him PNG will end in error. Remember this bundle – it will save time at every competition.
How Steghide hides data
For JPEG, stegide does not work with pixels directly, but with DCT coefficients (Discrete Cosine Transform) – numerical values that occur with JPEG compression. The algorithm rearranges the pairs of coefficients so that the statistical distribution of the image remains almost unchanged. That is why binwalk here is useless: there are no completed files, no extra signatures. Payload is woven into the compression structure itself, and it is impossible to detect it without the right tool.
For WAV steghide, it modifys the younger bits of audio samples. The human ear does not catch the difference, and the spectral analysis in Audacity usually does not show anomalies.
