Steganography Analyst

Steganography Analysis Skill

Detect and extract hidden data from images, audio, files, and text.

Setup

./setup.sh          # installs all tools project-locally (no sudo)
source scripts/env.sh

See SETUP.md for manual installation fallback.

Decision Tree

What file type are you analyzing?

Image (PNG/BMP)

1. exiftool image.png — check metadata for hidden fields
2. pngcheck -v image.png — validate structure, find hidden chunks
3. zsteg -a image.png — LSB pattern detection
4. python3 scripts/bit_plane_extract.py image.png --list — bit plane statistics
5. python3 scripts/png_crc_fix.py image.png — dimension/CRC mismatch
6. binwalk -e image.png — embedded file extraction
7. unzip image.png -d out/ — try as polyglot

Image (JPEG)

1. exiftool -v3 image.jpg — verbose metadata + structure
2. steghide extract -sf image.jpg — DCT coefficient extraction
3. jsteg reveal image.jpg — JPEG LSB
4. binwalk -e image.jpg — embedded data
5. If password-protected: stegseek --seed image.jpg first, then ask operator for wordlist path

Image (GIF)

1. Extract animation frames — look for hidden content in individual frames
2. gifsicle --color-info image.gif — palette manipulation check
3. binwalk -e image.gif — appended data

Audio (WAV/MP3/FLAC)

1. sox audio.wav -n spectrogram -o spectro.png — visual patterns in frequency domain
2. python3 scripts/wavsteg.py -i audio.wav -o out.txt -n 1 — LSB extraction
3. python3 scripts/wav_header_check.py audio.wav — appended data after audio
4. multimon-ng -t wav -a DTMF audio.wav — DTMF phone tones

Text File

1. cat -A file.txt | head — whitespace patterns (tabs/spaces encoding)
2. python3 scripts/zero_width_decode.py file.txt — zero-width Unicode
3. python3 scripts/homoglyph_detect.py file.txt — lookalike character substitution
4. stegsnow -C file.txt — snow whitespace steganography

Any File Type (First Pass)

file suspicious_file                    # true file type
strings -n 8 suspicious_file | head     # readable strings
binwalk suspicious_file                 # embedded file signatures
xxd suspicious_file | head -20          # magic bytes

Password Needed?

• stegseek --seed image.jpg — detect steghide data without a wordlist first
• stegseek image.jpg wordlist.txt — fast steghide cracker (Linux; on macOS: docker run --rm -it -v "$(pwd):/steg" rickdejager/stegseek)
• Ask the operator for wordlist path before brute-forcing. Common locations: /usr/share/wordlists/rockyou.txt (Kali), ~/wordlists/, or the operator may have a custom one. Don't assume a default path exists.
• Try common passwords first: password, flag, secret, the filename, challenge name

Bundled Scripts

All in scripts/, stdlib-only (except bit_plane_extract.py which needs Pillow+numpy):

External Tools

Installed project-locally by setup.sh. See COMMANDS.md for full usage.

Common Failure Modes

• zsteg returns noise: Try --all and look for patterns with high confidence scores, not raw output
• steghide says "could not extract": File may not contain steghide data, or wrong passphrase — try stegseek
• binwalk finds nothing: File may use LSB/visual stego, not embedded files — try zsteg or bit_plane_extract
• StegSolve won't start: Requires Java. Use python3 scripts/bit_plane_extract.py as a CLI alternative
• Zero-width decoder returns empty: File may use homoglyphs or whitespace encoding instead — try both detectors