Steganography

What is Steganography?

Steganography is the practice of hiding a secret message inside an ordinary-looking file — an image, a text file, or an audio clip — so nobody suspects a message is there at all.

Steganos = "covered", graphein = "to write".

Three words you must know:

• Cover file — the innocent carrier (e.g. cat.png).
• Payload — the secret data you hide.
• Stego file — the carrier after the secret is embedded (e.g. cat_stego.png).

Why it is used

• Covert communication where encryption alone would look suspicious.
• Invisible watermarking to prove ownership of media.
• Data exfiltration by attackers — payloads smuggled out inside image uploads.
• Malware staging — loaders pulling shellcode from a PNG on a CDN.
• CTF and CEH / eJPT / TryHackMe forensics challenges.

Real-world examples

• APT groups hiding command-and-control configuration inside images on public websites.
• Studios embedding invisible watermarks in screeners to trace leaks.
• Zero-width characters hidden in internal documents to fingerprint whoever leaks them.

Steganography vs Cryptography

Types of Steganography

Image steganography

• Description — the most common type. Secret bits replace the least significant bits (LSB) of pixel colour values, changing each colour by at most 1 — invisible to the eye.
• Common formats — PNG, BMP, GIF (lossless), JPEG (uses DCT coefficients instead).
• Real-world use — CTF challenges, invisible watermarks, malware hiding payloads in images.

Text steganography

• Description — the secret is hidden in the text itself: extra whitespace, zero-width Unicode characters, homoglyph letter swaps, or the first letter of each word (null cipher).
• Common formats — TXT, DOCX, HTML, chat messages.
• Real-world use — fingerprinting leaked documents, invisible tracking marks in emails.

Audio steganography (short overview)

• Description — secret bits are hidden in audio samples using LSB, phase coding or echo hiding; inaudible to the listener.
• Common formats — WAV and FLAC (lossless, reliable), MP3 (lossy, fragile).
• Real-world use — audio watermarking and broadcast monitoring, plus occasional CTF puzzles.

Popular Steganography Tools

Steghide — embed and extract password-protected, encrypted payloads.

• OS — Linux, Windows
• Typical use — hiding a text file inside a JPEG or WAV with a passphrase.

steghide embed -cf cat.jpg -ef secret.txt -p mypass
steghide extract -sf cat.jpg -p mypass

zsteg — automatically scan PNG/BMP files for LSB and other hidden data.

• OS — Linux, macOS (Ruby gem)
• Typical use — first tool to run on a suspicious PNG in a CTF.

zsteg -a suspect.png

OpenStego — beginner-friendly GUI for hiding data and watermarking.

• OS — Windows, Linux, macOS (Java)
• Typical use — learning steganography without the command line.

java -jar openstego.jar

StegSeek — ultra-fast brute-force cracker for Steghide passwords.

• OS — Linux
• Typical use — recovering an unknown Steghide passphrase with a wordlist.

stegseek suspect.jpg rockyou.txt

ExifTool — read, write and strip file metadata.

• OS — Linux, Windows, macOS
• Typical use — finding secrets left in EXIF comments, or stripping metadata before sharing.

exiftool suspect.png
exiftool -all= suspect.png

Binwalk — detect and extract files hidden or appended inside another file.

• OS — Linux
• Typical use — pulling a ZIP or JPEG that was concatenated onto a PNG.

binwalk suspect.png
binwalk -e suspect.png

strings — print readable text found anywhere inside a binary file.

• OS — Linux, Windows, macOS
• Typical use — the fastest 5-second check for a plaintext flag or note.

strings suspect.png | grep -i flag

Basic Workflow

   Original Image  (cover file)
          |
          v
   Hide Secret Message  (LSB embedding, optional password)
          |
          v
   Stego Image  (looks identical to the original)
          |
          v
   Share Image  (email, chat, upload)
          |
          v
   Receiver Extracts Message

Interactive Steganography Lab

Use the lab below to embed and recover a message with 1-bit RGB LSB encoding. Everything — decoding, bit manipulation and PNG re-encoding — happens on a local canvas inside your browser tab. No upload, no storage, no backend.

Beginner Tips