Image Steganography

The idea

Steganography hides data inside a carrier file without (visibly) changing it. In images, the most common technique uses the Least Significant Bit (LSB) of each pixel’s colour channels — changing the last bit of a red/green/blue value shifts the colour by 1/256, invisible to the eye but detectable by software.

First steps on every stego image

# 1. Check metadata
exiftool image.png
strings image.png

# 2. Look for appended data
binwalk image.png
binwalk -e image.png

# 3. Try common passwords with steghide (JPEG/BMP)
steghide extract -sf image.jpg -p ""
steghide extract -sf image.jpg -p "password"

StegSolve analysis

StegSolve (a Java tool) lets you flip through different colour-channel planes:

java -jar StegSolve.jar

Cycle through the bit planes with the arrow buttons. A hidden message in the LSB plane shows up as a noisy pattern, or you may see ASCII text directly in the 0-bit plane.

Analyse → Data Extract → select bit planes 0 for R, G, B → extract as text. Rearrange the order if the output looks scrambled.

zsteg — PNG LSB tool

gem install zsteg
zsteg image.png         # check all common bit planes
zsteg image.png -a      # aggressive — try every combination

zsteg reports detected strings and their bit-plane location.

Common password wordlist for steghide

Many CTF stego challenges use the flag itself, the challenge name, or steganography as the password. Try:

for pw in "" "password" "steganography" "ctf" "flag"; do
    steghide extract -sf image.jpg -p "$pw" 2>/dev/null && break
done

Audio steganography (bonus)

.wav and .mp3 files hide data in LSBs too, but also in spectrogram form. Open the file in Audacity → Spectrogram view. Text or an image often appears in the frequency domain.