Steganography Techniques

SKILL: Steganography Techniques — Expert Analysis Playbook

AI LOAD INSTRUCTION: Expert steganography detection and extraction techniques. Covers image steganography (LSB, PNG chunk hiding, JPEG DCT, EXIF metadata, dimension tricks, palette manipulation), audio steganography (spectrogram, LSB, DTMF, morse), file steganography (polyglots, binwalk, NTFS ADS, steghide), and text steganography (whitespace, zero-width Unicode, homoglyphs). Base models miss the systematic file-type-based analysis approach and tool-specific extraction workflows.

0. RELATED ROUTING

Before going deep, consider loading:

• traffic-analysis-pcap for extracting files from network captures before stego analysis
• memory-forensics-volatility for extracting files from memory dumps
• classical-cipher-analysis if extracted hidden data is further encrypted/encoded

Tool Reference

Also load STEGO_TOOLS_GUIDE.md when you need:

• Tool installation instructions and dependencies
• Detailed command reference for each stego tool
• Workflow patterns for specific file types

---

1. IMAGE STEGANOGRAPHY

LSB (Least Significant Bit)

LSB embeds data in the least significant bits of pixel color channels.

# zsteg — LSB analysis for PNG/BMP
zsteg image.png                       # auto-detect all LSB patterns
zsteg image.png -a                    # try all known methods
zsteg image.png -b 1                  # extract bit plane 1
zsteg image.png -E "b1,rgb,lsb,xy"   # specific extraction pattern

# StegSolve (Java GUI)
java -jar StegSolve.jar
# Navigate color planes: Red 0, Green 0, Blue 0 → look for hidden image/text
# Data Extractor: specify bit planes + byte order

# stegoveritas — comprehensive automated analysis
stegoveritas image.png
# Runs: exiftool, binwalk, zsteg, foremost, color plane extraction

PNG Specific

# pngcheck — validate structure, find hidden chunks
pngcheck -v image.png

# Hidden chunks: tEXt, zTXt (compressed text), iTXt (international text)
# Custom/private chunks may contain hidden data

# CRC vs dimensions trick
# If CRC doesn't match declared dimensions → image was cropped
# Fix: brute-force correct width/height → reveals hidden rows/columns
python3 -c "
import struct, zlib
with open('image.png','rb') as f:
    data = f.read()
# Check IHDR CRC at offset 29
ihdr = data[12:29]
for h in range(1,2000):
    for w in range(1,2000):
        new_ihdr = struct.pack('>II',w,h) + ihdr[8:]
        if zlib.crc32(b'IHDR'+new_ihdr) & 0xffffffff == struct.unpack('>I',data[29:33])[0]:
            print(f'Width: {w}, Height: {h}')
"

# APNG (animated PNG) — hidden frames
# Use apngdis to extract all frames: apngdis image.png

JPEG Specific

# steghide — embed/extract from JPEG (DCT coefficient modification)
steghide extract -sf image.jpg                 # extract (no passphrase)
steghide extract -sf image.jpg -p PASSWORD     # extract with passphrase
steghide info image.jpg                        # check if data is embedded

# stegcracker — brute force steghide passphrase
stegcracker image.jpg wordlist.txt

# jsteg — JPEG LSB steganography
jsteg reveal image.jpg output.txt

# JPEG structure analysis
exiftool -v3 image.jpg       # verbose metadata + structure
jpegdump image.jpg           # raw JPEG marker analysis

EXIF Metadata

# exiftool — comprehensive metadata extraction
exiftool image.jpg
exiftool -b -ThumbnailImage image.jpg > thumb.jpg   # extract thumbnail
exiftool -all= image.jpg                             # strip all metadata

# Hidden data in EXIF fields (comment, artist, copyright, etc.)
exiftool -Comment image.jpg
exiftool -UserComment image.jpg
strings image.jpg | grep -i "flag\|key\|secret"

Palette-Based (GIF)

# GIF color table manipulation — data in color palette order
gifsicle -I image.gif                    # info
gifsicle --color-info image.gif          # palette details
# Check for animation frames: convert -coalesce image.gif frame_%d.png

---

2. AUDIO STEGANOGRAPHY

Spectrogram Analysis

# Sonic Visualiser — best for spectrogram viewing
# Layer → Add Spectrogram → look for visual patterns (text/images)

# Audacity
# Analyze → Plot Spectrum
# Select audio → change view to Spectrogram

# sox for command-line spectrogram generation
sox audio.wav -n spectrogram -o spectro.png

Audio LSB

# DeepSound — hide/extract files in audio (Windows)
# GUI tool: open audio file → extract hidden files

# WavSteg — LSB in WAV files
python3 WavSteg.py -r -i audio.wav -o output.txt -n 1   # extract 1 LSB
python3 WavSteg.py -r -i audio.wav -o output.txt -n 2   # extract 2 LSBs

DTMF / Morse Code

# DTMF decoder (phone tones)
multimon-ng -t wav -a DTMF audio.wav

# Morse code
# Audacity → visual inspection of on/off pattern
# Online decoder or manual: .- = A, -... = B, etc.

# SSTV (Slow-Scan Television) — image in audio
qsstv                    # GUI decoder
# Or: RX-SSTV (Windows)

WAV Header Manipulation

# Check for data appended after WAV audio data
# WAV data chunk size vs actual file size
python3 -c "
import wave
w = wave.open('audio.wav','rb')
print(f'Frames: {w.getnframes()}, Channels: {w.getnchannels()}, Width: {w.getsampwidth()}')
expected = w.getnframes() * w.getnchannels() * w.getsampwidth() + 44  # 44 = WAV header
import os
actual = os.path.getsize('audio.wav')
if actual > expected:
    print(f'Extra data: {actual - expected} bytes appended')
"

---

3. FILE STEGANOGRAPHY

Polyglot Files

A single file that is valid in two or more formats simultaneously.

# Detection: check file with multiple tools
file suspicious_file
xxd suspicious_file | head          # check magic bytes
binwalk suspicious_file             # find embedded files

# Common polyglots: PDF+ZIP, JPEG+ZIP, JPEG+RAR, PNG+ZIP
# Try unzip on image files:
unzip image.jpg -d extracted/
7z x image.jpg -oextracted/

Appended / Embedded Data

# binwalk — scan for embedded files and data
binwalk image.png                   # scan
binwalk -e image.png                # extract embedded files
binwalk --dd='.*' image.png         # extract everything

# foremost — file carving
foremost -i suspicious_file -o output_dir/

# dd — manual extraction
# If binwalk shows embedded ZIP at offset 0x1234:
dd if=suspicious_file bs=1 skip=$((0x1234)) of=extracted.zip

NTFS Alternate Data Streams (ADS)

:: List ADS (Windows)
dir /r file.txt
Get-Item file.txt -Stream *

:: Read hidden stream
more < file.txt:hidden_stream
Get-Content file.txt -Stream hidden_stream

:: Create ADS (for testing)
echo "hidden data" > file.txt:secret

Steghide Brute Force

# stegcracker — wordlist attack on steghide passphrase
stegcracker image.jpg /usr/share/wordlists/rockyou.txt

# stegseek — faster alternative
stegseek image.jpg /usr/share/wordlists/rockyou.txt
# stegseek is ~10000x faster than stegcracker

---

4. TEXT STEGANOGRAPHY

Whitespace Encoding

# Tabs and spaces encode binary (tab=1, space=0 or vice versa)
# stegsnow — whitespace steganography
stegsnow -C message.txt                # extract hidden message
stegsnow -C -p PASSWORD message.txt    # extract with password

# Manual detection:
cat -A file.txt | head     # show tabs (^I) and line endings ($)
xxd file.txt | grep "09 20\|20 09"    # look for tab/space patterns

Zero-Width Characters

# Unicode invisible characters used for encoding:
# U+200B (Zero-Width Space), U+200C (ZWNJ), U+200D (ZWJ), U+FEFF (BOM)

# Detection:
python3 -c "
text = open('message.txt','r').read()
hidden = [c for c in text if ord(c) in [0x200b, 0x200c, 0x200d, 0xfeff]]
print(f'Found {len(hidden)} zero-width characters')
binary = ''.join('0' if ord(c)==0x200b else '1' for c in hidden)
# Convert binary to ASCII
"

# Online tools: holloway.nz/steg, Unicode Steganography decoders

Homoglyph Substitution

# Visually identical characters from different Unicode blocks
# e.g., Latin 'a' (U+0061) vs Cyrillic 'а' (U+0430)

# Detection:
python3 -c "
text = open('message.txt','r').read()
for i, c in enumerate(text):
    if ord(c) > 127:
        print(f'Position {i}: char={c} ord={ord(c)} name={__import__(\"unicodedata\").name(c,\"?\")}')
"

---

5. DECISION TREE

Suspect hidden data — what file type?
│
├── Image (PNG/BMP)?
│   ├── Check metadata: exiftool (§1 EXIF)
│   ├── Check structure: pngcheck, binwalk (§1 PNG)
│   ├── LSB analysis: zsteg, StegSolve (§1 LSB)
│   ├── Check dimensions vs CRC: height/width brute force (§1 PNG)
│   ├── Check for appended data: binwalk -e (§3)
│   └── Try as polyglot: unzip/7z (§3)
│
├── Image (JPEG)?
│   ├── Check metadata: exiftool (§1 EXIF)
│   ├── Try steghide: steghide extract (§1 JPEG)
│   │   └── Password protected? → stegseek brute force (§3)
│   ├── Try jsteg: jsteg reveal (§1 JPEG)
│   ├── Check for appended data: binwalk -e (§3)
│   └── Check thumbnail: exiftool -b -ThumbnailImage (§1 EXIF)
│
├── Image (GIF)?
│   ├── Check frames: extract all animation frames (§1 Palette)
│   ├── Check palette: gifsicle --color-info (§1 Palette)
│   └── Check for appended data: binwalk -e (§3)
│
├── Audio (WAV/MP3/FLAC)?
│   ├── Spectrogram: Sonic Visualiser / Audacity (§2)
│   ├── LSB: WavSteg (§2)
│   ├── DTMF tones: multimon-ng (§2)
│   ├── Morse code: manual or decoder (§2)
│   ├── SSTV: qsstv (§2)
│   └── Check file size vs expected: header analysis (§2)
│
├── Text file?
│   ├── Check whitespace: cat -A, stegsnow (§4)
│   ├── Check zero-width chars: Unicode analysis (§4)
│   ├── Check homoglyphs: non-ASCII detection (§4)
│   └── Check encoding: multiple base decodings
│
├── Any file type?
│   ├── strings: strings -n 8 file | grep -i "flag\|key\|pass"
│   ├── binwalk: binwalk -e file (embedded files) (§3)
│   ├── file: file suspicious_file (true type)
│   ├── xxd: check magic bytes, compare headers
│   └── NTFS? → check ADS: dir /r (§3)
│
└── Password/passphrase needed?
    ├── steghide → stegseek / stegcracker (§3)
    ├── Check challenge description for hints
    └── Try common passwords: password, file name, challenge name

STEGANOGRAPHY TOOLS GUIDE

Supplementary reference for steganography-techniques. Installation and detailed usage for each tool.

---

1. MULTI-PURPOSE TOOLS

stegoveritas

Automated steganography analysis — runs multiple tools in one pass.

# Install
pip3 install stegoveritas
stegoveritas_install_deps

# Usage — full automated analysis
stegoveritas image.png
# Runs: exiftool, binwalk, zsteg, foremost, trailing data check
# Extracts: color planes, LSB data, embedded files
# Output: results/ directory with all findings

stegoveritas image.png -meta         # metadata only
stegoveritas image.png -imageTransform   # color plane extraction only
stegoveritas image.png -extractLSB   # LSB extraction only

binwalk

Firmware/file analysis and extraction.

# Install
sudo apt install binwalk
# or: pip3 install binwalk

# Scan for embedded files
binwalk file.png

# Extract embedded files
binwalk -e file.png                  # extract known types
binwalk --dd='.*' file.png           # extract everything
binwalk -Me file.png                 # recursive extraction

# Entropy analysis (detect encrypted/compressed regions)
binwalk -E file.png

foremost

File carving tool — recovers files from raw data.

# Install
sudo apt install foremost

# Carve files
foremost -i suspicious_file -o output_dir/
foremost -t all -i disk_image.raw -o carved/

# Specific file types
foremost -t pdf,jpg,zip -i data.bin -o output/

---

2. IMAGE TOOLS

zsteg

PNG/BMP LSB steganography detector.

# Install
gem install zsteg

# Auto-detect all LSB patterns
zsteg image.png

# Verbose scan with all methods
zsteg image.png -a

# Specific extraction
zsteg image.png -b 1                        # bit plane 1
zsteg image.png -E "b1,rgb,lsb,xy"          # specific pattern
zsteg image.png -E "b1,r,lsb,xy"            # red channel only
zsteg image.png -E "b2,bgr,msb,yx"          # MSB, BGR order

# Extract to file
zsteg image.png -E "b1,rgb,lsb,xy" > extracted.bin

StegSolve

Java GUI for visual bit plane analysis.

# Install
wget http://www.caesum.com/handbook/Stegsolve.jar

# Run
java -jar Stegsolve.jar

# Key features:
# Analyse → File Format: check headers and structure
# Analyse → Data Extract: specify bit planes to extract
# Arrow keys: cycle through color planes (R0-R7, G0-G7, B0-B7, Alpha)
# XOR/AND/OR with second image for comparison

steghide

JPEG/WAV/BMP/AU steganography with encryption.

# Install
sudo apt install steghide

# Check if data is embedded
steghide info image.jpg

# Extract (no password)
steghide extract -sf image.jpg

# Extract with password
steghide extract -sf image.jpg -p "password"

# Embed data (for testing)
steghide embed -cf cover.jpg -ef secret.txt -p "password"

stegseek

Fast steghide passphrase cracker (~10000x faster than stegcracker).

# Install
wget https://github.com/RickdeJager/stegseek/releases/latest/download/stegseek_amd64.deb
sudo dpkg -i stegseek_amd64.deb

# Crack passphrase
stegseek image.jpg /usr/share/wordlists/rockyou.txt

# Seed crack (try without wordlist)
stegseek --seed image.jpg

jsteg

JPEG LSB steganography.

# Install
go install github.com/lukechampine/jsteg@latest

# Extract
jsteg reveal image.jpg

# Embed (for testing)
jsteg hide cover.jpg secret.txt output.jpg

pngcheck

PNG structure validator.

# Install
sudo apt install pngcheck

# Validate and show chunk info
pngcheck -v image.png

# Show text chunks
pngcheck -t image.png

# Full verbose with data
pngcheck -vtp7f image.png

exiftool

Metadata extraction and manipulation.

# Install
sudo apt install libimage-exiftool-perl

# All metadata
exiftool image.jpg

# Specific fields
exiftool -Comment image.jpg
exiftool -UserComment image.jpg
exiftool -GPSLatitude -GPSLongitude image.jpg

# Extract thumbnail
exiftool -b -ThumbnailImage image.jpg > thumbnail.jpg

# Verbose structure
exiftool -v3 image.jpg

# Strip all metadata
exiftool -all= image.jpg

---

3. AUDIO TOOLS

Sonic Visualiser

Best spectrogram viewer for stego analysis.

# Install
sudo apt install sonic-visualiser

# Usage:
# 1. Open audio file
# 2. Layer → Add Spectrogram
# 3. Adjust: Window=4096, Overlap=87.5%, Scale=dBV
# 4. Look for patterns (text, QR codes, images in frequency domain)

multimon-ng

Decoder for DTMF, POCSAG, and other digital modes.

# Install
sudo apt install multimon-ng

# DTMF decode
multimon-ng -t wav -a DTMF audio.wav

# Multiple decoders
multimon-ng -t wav -a DTMF -a MORSE_CW audio.wav

# From raw audio input
sox audio.wav -t raw -r 22050 -e signed -b 16 -c 1 - | multimon-ng -t raw -

DeepSound

Audio steganography tool (Windows).

# GUI application — Windows only
# 1. Open carrier audio file
# 2. Click "Extract Secret Files"
# 3. Enter password if prompted

# Alternative for Linux: use WavSteg for WAV LSB analysis

---

4. TEXT TOOLS

stegsnow

Whitespace steganography in text files.

# Install
sudo apt install stegsnow

# Extract hidden message
stegsnow -C message.txt

# Extract with password
stegsnow -C -p "password" message.txt

# Embed (for testing)
stegsnow -C -m "hidden message" -p "password" cover.txt stego.txt

---

5. RECOMMENDED ANALYSIS WORKFLOW

Quick Triage (Any File)

file suspicious_file
exiftool suspicious_file
strings -n 8 suspicious_file | head -50
binwalk suspicious_file
xxd suspicious_file | head -20

Image Deep Analysis

exiftool -v3 image.*
pngcheck -v image.png         # if PNG
steghide info image.jpg       # if JPEG
zsteg -a image.png            # if PNG/BMP
stegoveritas image.*          # comprehensive automated scan
binwalk -e image.*            # embedded file extraction

Audio Deep Analysis

exiftool audio.*
file audio.*
sox audio.wav -n spectrogram -o spectro.png
multimon-ng -t wav -a DTMF audio.wav
# Open in Sonic Visualiser for spectrogram inspection
# Check file size vs expected duration

Password Recovery for Steghide

# Fast: stegseek
stegseek image.jpg /usr/share/wordlists/rockyou.txt

# Slow fallback: stegcracker
stegcracker image.jpg /usr/share/wordlists/rockyou.txt

# Manual: try common passwords
for p in password flag secret admin test ""; do
    steghide extract -sf image.jpg -p "$p" 2>/dev/null && echo "Password: '$p'" && break
done