Introduction to Steganography Tools for CTF

Introduction

You already know the idea: a flag smuggled inside an ordinary-looking PNG, WAV, or PDF, in the one place nobody thinks to look. What stops most solvers is not the concept, it is remembering which of a dozen tools handles which file type, how to install it, and the exact incantation to pull the payload back out. This page is that bench reference.

It covers the six tools you reach for most often (zsteg, Stepic, steghide, stegcracker, Stegsolve, and binwalk): the file types each one handles, the install command, and the exact invocation, with each section linking to the picoCTF challenge where it was the key to the solve so you can see it working on a real file.

zsteg: PNG and BMP bit-plane scanner

zsteg is the fastest way to extract data hidden in the least-significant (or most-significant) bits of PNG and BMP pixel values. It automatically checks dozens of channel/bit-depth/endianness combinations and prints anything that looks like text, so one command often reveals the flag outright.

The reason LSB hiding is invisible is arithmetic. A 24-bit RGB pixel gives 256 levels per channel, so flipping the lowest bit changes a channel by 1/255, roughly 0.4%, which no eye resolves. The capacity is large for the same reason: at one bit per channel a 1920 by 1080 RGB image carries 777,600 bytes of payload, about 760 KB, without altering the visible picture. This only works because PNG is losslessly compressed with DEFLATE; the same trick applied to a JPEG is destroyed the moment the image is re-encoded.

Install

sudo apt install ruby ruby-dev
sudo gem install zsteg

Basic usage

zsteg image.png          # scan all common channels
zsteg -a image.png       # exhaustive scan (slower, catches edge cases)

The output lists each channel it checks (e.g. b1,rgba,lsb,xy) alongside anything it extracts. Scan the text column for readable strings or a Base64 blob and copy it out for further decoding.

What to look for

If you see a long Base64 string in one of the channels, pipe it straight through base64 -d. If the output looks like compressed data, try zsteg -e "b1,rgba,lsb,xy" image.png | file - to identify the format before saving it.

Stepic: Python LSB steganography

Stepic is a Python library and command-line tool that hides and extracts text using the standard LSB-of-RGBA algorithm. It is simpler than zsteg and only handles that one encoding, but if a challenge was created specifically with Stepic then it is the right tool to reach for, as zsteg may not recognise the exact byte layout.

Install

pip install stepic
# or inside a virtual environment:
python3 -m venv venv && source venv/bin/activate
pip install stepic

Usage

stepic -d -i image.png                     # decode: hidden data to stdout
stepic -d -i image.png -o secret.txt       # decode: hidden data to a file
stepic -e -i cover.png -t secret.txt -o output.png   # encode
#   -i/--image-in  the carrier image
#   -t/--data-in   the file to hide (encode only)
#   -o/--out       data when decoding, image when encoding

steghide: JPEG and BMP passphrase extraction

steghide embeds data inside JPEG and BMP files using a passphrase-based scheme. Unlike LSB tools, steghide modifies the DCT coefficients of JPEGs rather than raw pixel bits, making the embedding statistically harder to detect. In CTF challenges the passphrase is either blank (press Enter when prompted) or hidden somewhere else in the challenge: check IRC logs, metadata, or another file.

The DCT detail is what makes it survive JPEG compression. ITU-T T.81, the JPEG standard, splits the image into 8 by 8 pixel blocks and transforms each into 64 frequency coefficients before quantisation. steghide edits those already-quantised coefficients, so the payload lives downstream of the lossy step rather than being erased by it. Per its manual, it also encrypts the embedded data (Blowfish by default) and checksums it with CRC32, which is why a wrong passphrase fails cleanly instead of yielding garbage.

Install

sudo apt install steghide

Usage

steghide extract -sf image.jpg          # prompts for passphrase (try blank first)
steghide extract -sf image.jpg -p ''    # blank passphrase, non-interactive
steghide extract -sf image.jpg -p 'secretpassword'
steghide info image.jpg                 # check if any payload is embedded

After extraction, steghide writes a file (often named in the embed step). Read it with cat or inspect it with file to determine the next step.

stegcracker: brute-force steghide passwords

stegcracker automates passphrase brute-forcing for steghide. You hand it an image and a wordlist and it tries every password until extraction succeeds. It is the steganography equivalent of Hashcat or John the Ripper.

Set expectations before you start it. rockyou.txt, the wordlist that ships with Kali, holds over 14 million entries recovered from the 2009 RockYou breach, and stegcracker has to invoke a full steghide extraction attempt per candidate rather than hashing in bulk. Throughput is therefore measured in thousands of guesses per second, not billions, so a full rockyou pass is minutes and an eight-character random passphrase is simply out of reach. If rockyou fails, the answer is in the challenge text, not in a bigger wordlist.

Install

pip3 install stegcracker
# requires steghide to be installed as well
sudo apt install steghide

Usage

stegcracker image.jpg wordlist.txt
# Common wordlists to try:
stegcracker image.jpg /usr/share/wordlists/rockyou.txt
# Specify output file name:
stegcracker image.jpg wordlist.txt --output extracted.txt

If the wordlist doesn't work, look for clues in the challenge about how the password was constructed. In some challenges the password follows a predictable pattern (for example, concatenated words from a specific category) and you can generate a custom wordlist with a small Python script.

# Example: generate candidate passwords from a list of words
python3 -c "
words = open('words.txt').read().splitlines()
for a in words:
    for b in words:
        print('prefix' + a + b)
" > custom_wordlist.txt
stegcracker image.bmp custom_wordlist.txt

Stegsolve: bit-plane visualiser

Stegsolve is a Java GUI tool that lets you visually inspect every bit plane of an image. While zsteg extracts text data automatically, Stegsolve shines when the hidden content is encoded in the most-significant bits (MSB) rather than the LSB, or when you need to visualise what the different planes look like to understand the encoding scheme.

Its Analyse > Data Extract panel is the main workhorse: you select which colour channels and which bit positions to include, choose row or column order, and Stegsolve assembles the bits into a byte stream you can save to a file or search with strings.

Install

wget http://www.caesum.com/handbook/Stegsolve.jar -O stegsolve.jar
chmod +x stegsolve.jar
java -jar stegsolve.jar

Extracting MSB data

1. Open the image via File > Open.
2. Go to Analyse > Data Extract.
3. In the bit selection grid, tick Red 7, Green 7, Blue 7 (bit 7 = MSB).
4. Set Bit Order to MSB First.
5. Click Preview and look for readable text at the top.
6. Use Save Text then grep pico to isolate the flag.

binwalk: embedded file carving

binwalk is not a steganography tool in the traditional sense. It does not look at pixel bit planes. Instead, it scans any file for known file-format magic bytes (ZIP signatures, PNG headers, ELF headers, etc.) and reports every embedded file it finds, along with its byte offset. When a PNG has a ZIP archive stitched on after the image data ends, binwalk will catch it instantly.

That PNG-plus-ZIP polyglot works because the two formats read from opposite ends. The PNG specification makes the IEND chunk terminal, so a decoder stops there and ignores every trailing byte, while PKWARE's APPNOTE.TXT has ZIP readers locate the End of Central Directory record by scanning backwards from the end of the file. Both parsers are satisfied by the same bytes. This is also why cat image.png archive.zip > out.png produces a file that opens as an image and unzips as an archive, and why the fastest first check on any image is comparing the file size against where IEND sits.

Install

sudo apt install binwalk

Usage

binwalk image.png           # list embedded files and their offsets
binwalk -e image.png        # automatically extract everything found
binwalk -Me image.png       # recursive extraction (extract from extracted files too)

After running binwalk -e image.png, check the created _image.png.extracted/ directory for the carved-out files. If the extracted archive is password-protected, look elsewhere in the challenge for the key.

You can also extract manually if automatic extraction fails. Use dd with the byte offset from binwalk's output:

# Example: extract ZIP starting at offset 39804
dd if=image.png bs=1 skip=39804 of=embedded.zip
unzip embedded.zip

Quick reference

Not sure which tool to start with? Use this table as a decision guide based on the file type you receive.

Sources and further reading

Steganography tooling is a thin layer over three file-format specs. Once you can read those, you can predict what each tool will and will not find.

• The PNG specification for the 8-byte signature, chunk structure, and the terminal IEND chunk that makes trailing-data polyglots possible.
• ITU-T T.81 (JPEG) for the 8x8 block DCT and the 64 coefficients steghide hides inside.
• PKWARE APPNOTE.TXT for the End of Central Directory record and why ZIP parsers read backwards.
• Tool documentation: steghide manual (supported formats, encryption, checksum), zsteg, and binwalk.