Where to start: file, strings and basic intelligence
The main mistake of beginners in stego-tasks is to grab specialized tools for steganography without making basic checks. File with extension .png may be a renamed ZIP archive, and the flag can be lying open text directly inside binary data.
Team file determines the real format by magictes in the title, not the extension. Launching file suspicious.png and see Zip archive data instead of PNG image – Extension lies. This step takes a second, but saves hours.
Further – strings. The utility pulls out all readable text sequences from the binary file. In forensic CTF assignments, flags are often hidden without any encryption: strings image.png | grep -i "flag". Filtering through grep by keywords (flag, ctf, key, password, hint) – mandatory reception. According to hacklido.com, strings decides a noticeable part of the entry-level stego-tassks at all without additional tools. Seriously, just strings and grep.
If strings nothing gave, look at hex-dump: xxd image.png | head -50. Anomalies in the title, extra data after the end-of-file marker (EOF), non-standard byte sequences - all this can be seen here. To work with hex on Linux is suitable xxd or hexdump, on Windows — HxD or 010 Editor.
Exiftool: Image metadata as a source of clues
Analysis of file metadata is the second stage after basic exploration. The authors of CTF assignments regularly hide flags and hints in the EXIF fields: Comment, Artist, Copyright, GPS coordinates, XMP and IPTC.
Exiftool – standard for metadata extraction. Works with JPEG, PNG, TIFF, PDF, audio, video and dozens of other formats. Basic challenge: exiftool file.jpg – outputs all available metadata. At competitions, aiming is useful: exiftool file.jpg | grep -i "comment\|author\|flag".
What to look at in the conclusion:
Comment is the most popular hidden data field on CTF
Artist / Author — sometimes contains a base64 line that needs to be decoded
GPS Coordinates – can indicate the next stage of a multi-step task
Software – if the image is processed steghide or OpenStego, it is a direct hint of the method of concealment
Thumbnail – the built-in thumbnail is occasionally different from the main image and contains a flag
The main advantage of exiftool is that it shows non-standard and custom fields that ordinary viewers completely ignore. If the author of the task manually added an arbitrary tag, the standard programs will miss it, and exiftool - no.
Interesting detail: exiftool is present in GTFOBins - a list of Linux utilities applicable for post-exploitation. In the CTF context, it is rather a funny fact, but in a real digital foresex it is worth remembering: the processing of malicious files through an exiftool can itself become an attack vector.
Binwalk: examples of use to extract nested files
Binwalk scans the binary file into known signatures (ZIP, RAR, gzip, ELF, file systems headers) and shows their offset. This is the main tool for detecting the overlay method – file concatenation, when an archive or other file is simply glued to the image.
The overlay method, detailed in the Securelist study, is one of the most common steganography techniques in CTF. The principle is simple: a RAR archive is glued to JPEG. The picture viewer reads the data to the end marker of JPEG, and the archiver skips everything up to the signature RAR!. For a person, the file looks like a regular picture, but the binwalk sees both signatures.
Basic analysis: binwalk image.png. Typical Conclusion:
DECIMAL HEXADECIMAL DESCRIPTION
0 0x0 PNG image, 800 x 600
1024567 0xFA037 Zip archive data, name: flag.txt
1048576 0x100000 End of Zip archive
Extraction: binwalk -e image.png creates a directory _image.png.extracted/ with unpacked data. For recursive extraction (archive in the archive in the picture - there is also such, yes) there is a flag -Me: binwalk -Me image.png.
A common trap: binwalk sometimes finds false signatures — random byte sequences that coincide with the headings of known formats. If the utility shows dozens of finds in a 500 KB file, most of them are noise. Check every file you have learned through filebefore wasting time on analysis.
Steghide: data extraction and password hacking
Steghide is a steganography classic in CTF. It works with only four formats: JPEG, BMP, WAV, AU. This is critical: if you have been given PNG – steghide is useless, move on to zsteg.
Checking the availability of the attachment: steghide info cover.jpg. The program will tell you if there are built-in data and request a password.
The first action is to always try an empty password: steghide extract -sf cover.jpg (the program will request a password interactively - press Enter for empty; option with -p "" works, but in some shells, quotation marks may be interpreted incorrectly). Surprisingly often, the tash authors either do not set a password or an empty password and there is a part of the task. If the password is not empty, check the metadata (exiftool could show a hint), file name and description of the task.
Extraction with a known password: steghide extract -sf cover.jpg -p "s3cret". The result is a file whose name stegide will report when extracted.
Stegseek — fast steghide password brutforce
When an empty password does not fit and there are no hints, stegseek will be useful. This is the fastest tool for sorting out steghide passwords – it drives the rockyou.txt dictionary in seconds, while the outdated StegCracker spends the same minute or hour. The difference in order.
Challenge: stegseek cover.jpg /usr/share/wordlists/rockyou.txt. If successful, stegseek will show the found password and automatically extract the hidden file. Installation on Kali/Debian: apt install stegseek.
If stegseek does not find a password on rockyou - most likely, the password is non-standard and it needs to be obtained from another stage of the task, and not to sort through. Do not rest in the brutforce - return to the description of the task.
LSB steganography: zsteg for PNG and BMP analysis
LSB steganography is a method in which hidden data is recorded in the younger bits of pixels. The change of the last bit of each color channel (R, G, B) is almost invisible visually. When using 1 junior bit per RGB channel, approximately 8 bytes of container data is required to hide 1 byte - that is, a graphic file of about 8 MB is needed for 1 MB of information. (Remember my 12MB cat from the beginning? Here's the arithmetic.)
Zsteg is a specialized tool for finding LSB steganography in PNG and BMP files. Installation: gem install zsteg (in case of access rights error - gem install --user-install zsteg or use rbenv/rvm).
Full analysis: zsteg -a file.png starts all verification methods across all channels and combinations of bits. The output is voluminous - look for lines similar to the text, base64 or file signatures.
Extract a specific payload: if zsteg showed data in a particular channel (e.g., b1,rgb,lsb,xy), you can get them by the team zsteg -E b1,rgb,lsb,xy file.png > output.bin.
For visual analysis of bit planes, there is a Stegsolve – Java application with GUI. It allows you to switch between the planes of the arrows and detect hidden patterns with your eyes. When the zsteg automation does not find anything, manual viewing of planes through Stegsolve sometimes helps out – especially if the data is encoded in a non-standard way or distributed over multiple channels.
Hidden data in audio files
Audio-steganography is a separate layer of CTF-forensics, which many beginners completely miss. In vain. The approaches are different, and if you don't know where to look, you will lose a lot of time.
Spectrogram: visual messages in sound
The most frequent type of audio stego at competitions is a hidden image or text in a spectrogram. Open WAV or MP3 in Sonic Visualizer (free, cross-platform), add a spectrogram layer through Layer → Add Spectrogram. Flags are often “drawn” in letters in the high-frequency range (above 15 kHz) – you will not notice anything by ear, but visually the text is clearly visible. When you first see the letters on the spectrogram, the feeling of magic.
LSB in WAV files
WavSteg is a Python tool for extracting data from the WWAV’s junior bit. Challenge: python3 WavSteg.py -r -s audio.wav -o output.txt. The principle is similar to LSB in images: a container - audio samples instead of pixels.
Remember to check audio files (WAV, AU) via steghide — it supports these formats on a par with JPEG and BMP. Team steghide info audio.wav with an empty password, a must-have step.
Checklist: Stego-Task Disassembly algorithm on CTF
The order of action from simple to complex. Each step is done before the next – it is fundamentally:
file task_file – real type by magictes
strings task_file | grep -i "flag\|ctf\|key\|pass" – text in binary data
exiftool task_file – metadata (Comment, Author, GPS)
binwalk task_file – nested files; when finding: binwalk -e task_file
For JPEG/BMP/WAV/AU: steghide extract -sf task_file -p "" – empty password
For PNG/BMP: zsteg -a task_file – LSB analysis
For audio: Sonic Visualizer → spectrogram
If the steghide password is unknown: stegseek task_file rockyou.txt
Hex editor — manual search for anomalies
The main mistake of beginners in stego-tasks is to grab specialized tools for steganography without making basic checks. File with extension .png may be a renamed ZIP archive, and the flag can be lying open text directly inside binary data.
Team file determines the real format by magictes in the title, not the extension. Launching file suspicious.png and see Zip archive data instead of PNG image – Extension lies. This step takes a second, but saves hours.
Further – strings. The utility pulls out all readable text sequences from the binary file. In forensic CTF assignments, flags are often hidden without any encryption: strings image.png | grep -i "flag". Filtering through grep by keywords (flag, ctf, key, password, hint) – mandatory reception. According to hacklido.com, strings decides a noticeable part of the entry-level stego-tassks at all without additional tools. Seriously, just strings and grep.
If strings nothing gave, look at hex-dump: xxd image.png | head -50. Anomalies in the title, extra data after the end-of-file marker (EOF), non-standard byte sequences - all this can be seen here. To work with hex on Linux is suitable xxd or hexdump, on Windows — HxD or 010 Editor.
Exiftool: Image metadata as a source of clues
Analysis of file metadata is the second stage after basic exploration. The authors of CTF assignments regularly hide flags and hints in the EXIF fields: Comment, Artist, Copyright, GPS coordinates, XMP and IPTC.
Exiftool – standard for metadata extraction. Works with JPEG, PNG, TIFF, PDF, audio, video and dozens of other formats. Basic challenge: exiftool file.jpg – outputs all available metadata. At competitions, aiming is useful: exiftool file.jpg | grep -i "comment\|author\|flag".
What to look at in the conclusion:
Comment is the most popular hidden data field on CTF
Artist / Author — sometimes contains a base64 line that needs to be decoded
GPS Coordinates – can indicate the next stage of a multi-step task
Software – if the image is processed steghide or OpenStego, it is a direct hint of the method of concealment
Thumbnail – the built-in thumbnail is occasionally different from the main image and contains a flag
The main advantage of exiftool is that it shows non-standard and custom fields that ordinary viewers completely ignore. If the author of the task manually added an arbitrary tag, the standard programs will miss it, and exiftool - no.
Interesting detail: exiftool is present in GTFOBins - a list of Linux utilities applicable for post-exploitation. In the CTF context, it is rather a funny fact, but in a real digital foresex it is worth remembering: the processing of malicious files through an exiftool can itself become an attack vector.
Binwalk: examples of use to extract nested files
Binwalk scans the binary file into known signatures (ZIP, RAR, gzip, ELF, file systems headers) and shows their offset. This is the main tool for detecting the overlay method – file concatenation, when an archive or other file is simply glued to the image.
The overlay method, detailed in the Securelist study, is one of the most common steganography techniques in CTF. The principle is simple: a RAR archive is glued to JPEG. The picture viewer reads the data to the end marker of JPEG, and the archiver skips everything up to the signature RAR!. For a person, the file looks like a regular picture, but the binwalk sees both signatures.
Basic analysis: binwalk image.png. Typical Conclusion:
DECIMAL HEXADECIMAL DESCRIPTION
0 0x0 PNG image, 800 x 600
1024567 0xFA037 Zip archive data, name: flag.txt
1048576 0x100000 End of Zip archive
Extraction: binwalk -e image.png creates a directory _image.png.extracted/ with unpacked data. For recursive extraction (archive in the archive in the picture - there is also such, yes) there is a flag -Me: binwalk -Me image.png.
A common trap: binwalk sometimes finds false signatures — random byte sequences that coincide with the headings of known formats. If the utility shows dozens of finds in a 500 KB file, most of them are noise. Check every file you have learned through filebefore wasting time on analysis.
Steghide: data extraction and password hacking
Steghide is a steganography classic in CTF. It works with only four formats: JPEG, BMP, WAV, AU. This is critical: if you have been given PNG – steghide is useless, move on to zsteg.
Checking the availability of the attachment: steghide info cover.jpg. The program will tell you if there are built-in data and request a password.
The first action is to always try an empty password: steghide extract -sf cover.jpg (the program will request a password interactively - press Enter for empty; option with -p "" works, but in some shells, quotation marks may be interpreted incorrectly). Surprisingly often, the tash authors either do not set a password or an empty password and there is a part of the task. If the password is not empty, check the metadata (exiftool could show a hint), file name and description of the task.
Extraction with a known password: steghide extract -sf cover.jpg -p "s3cret". The result is a file whose name stegide will report when extracted.
Stegseek — fast steghide password brutforce
When an empty password does not fit and there are no hints, stegseek will be useful. This is the fastest tool for sorting out steghide passwords – it drives the rockyou.txt dictionary in seconds, while the outdated StegCracker spends the same minute or hour. The difference in order.
Challenge: stegseek cover.jpg /usr/share/wordlists/rockyou.txt. If successful, stegseek will show the found password and automatically extract the hidden file. Installation on Kali/Debian: apt install stegseek.
If stegseek does not find a password on rockyou - most likely, the password is non-standard and it needs to be obtained from another stage of the task, and not to sort through. Do not rest in the brutforce - return to the description of the task.
LSB steganography: zsteg for PNG and BMP analysis
LSB steganography is a method in which hidden data is recorded in the younger bits of pixels. The change of the last bit of each color channel (R, G, B) is almost invisible visually. When using 1 junior bit per RGB channel, approximately 8 bytes of container data is required to hide 1 byte - that is, a graphic file of about 8 MB is needed for 1 MB of information. (Remember my 12MB cat from the beginning? Here's the arithmetic.)
Zsteg is a specialized tool for finding LSB steganography in PNG and BMP files. Installation: gem install zsteg (in case of access rights error - gem install --user-install zsteg or use rbenv/rvm).
Full analysis: zsteg -a file.png starts all verification methods across all channels and combinations of bits. The output is voluminous - look for lines similar to the text, base64 or file signatures.
Extract a specific payload: if zsteg showed data in a particular channel (e.g., b1,rgb,lsb,xy), you can get them by the team zsteg -E b1,rgb,lsb,xy file.png > output.bin.
For visual analysis of bit planes, there is a Stegsolve – Java application with GUI. It allows you to switch between the planes of the arrows and detect hidden patterns with your eyes. When the zsteg automation does not find anything, manual viewing of planes through Stegsolve sometimes helps out – especially if the data is encoded in a non-standard way or distributed over multiple channels.
Hidden data in audio files
Audio-steganography is a separate layer of CTF-forensics, which many beginners completely miss. In vain. The approaches are different, and if you don't know where to look, you will lose a lot of time.
Spectrogram: visual messages in sound
The most frequent type of audio stego at competitions is a hidden image or text in a spectrogram. Open WAV or MP3 in Sonic Visualizer (free, cross-platform), add a spectrogram layer through Layer → Add Spectrogram. Flags are often “drawn” in letters in the high-frequency range (above 15 kHz) – you will not notice anything by ear, but visually the text is clearly visible. When you first see the letters on the spectrogram, the feeling of magic.
LSB in WAV files
WavSteg is a Python tool for extracting data from the WWAV’s junior bit. Challenge: python3 WavSteg.py -r -s audio.wav -o output.txt. The principle is similar to LSB in images: a container - audio samples instead of pixels.
Remember to check audio files (WAV, AU) via steghide — it supports these formats on a par with JPEG and BMP. Team steghide info audio.wav with an empty password, a must-have step.
Checklist: Stego-Task Disassembly algorithm on CTF
The order of action from simple to complex. Each step is done before the next – it is fundamentally:
file task_file – real type by magictes
strings task_file | grep -i "flag\|ctf\|key\|pass" – text in binary data
exiftool task_file – metadata (Comment, Author, GPS)
binwalk task_file – nested files; when finding: binwalk -e task_file
For JPEG/BMP/WAV/AU: steghide extract -sf task_file -p "" – empty password
For PNG/BMP: zsteg -a task_file – LSB analysis
For audio: Sonic Visualizer → spectrogram
If the steghide password is unknown: stegseek task_file rockyou.txt
Hex editor — manual search for anomalies
