ctf-forensics-extraction
When to Use
- Extracting embedded files from composite binaries or firmware
- Analyzing memory dumps with Volatility (process lists, credentials, network)
- Reconstructing TCP sessions and extracting files from PCAP captures
- Detecting steganographic payloads in images or audio
- Mounting disk images and recovering deleted files
- Analyzing file metadata (EXIF, PDF, Office XML)
Quick Start
# Binwalk: extract all embedded files
binwalk -eM suspicious.bin
# Volatility: identify profile + list processes
vol.py -f memory.dmp imageinfo
vol.py -f memory.dmp --profile=Win10x64 pslist
# PCAP: extract HTTP objects
tshark -r capture.pcap --export-objects http,exported/
# Image stego: quick LSB check
zsteg challenge.png 2>/dev/null | head -20
Forensics Decision Tree
Challenge file received
│
├─ Binary blob / firmware / archive
│ ├─ binwalk -eM → recursive extract
│ ├─ foremost / scalpel → file carving
│ └─ Check entropy plot for encrypted sections
│
├─ Memory dump (.dmp, .raw, .mem)
│ ├─ Volatility: imageinfo → profile
│ ├─ pslist → pstree → suspicious processes
│ ├─ netscan → network connections
│ ├─ filescan + dumpfiles → recover files
│ └─ cmdscan / consoles → command history
│
├─ PCAP / network capture
│ ├─ tshark --export-objects → HTTP/SMB/TFTP files
│ ├─ scapy TCP stream reconstruction
│ └─ DNS exfiltration: subdomain → base64/hex decode
│
├─ Image / audio file
│ ├─ file + exiftool + strings → quick metadata
│ ├─ PNG/BMP: zsteg, LSB extraction
│ ├─ JPEG: steghide (try empty password)
│ ├─ Audio: spectrogram, SSTV, LSB
│ └─ binwalk → embedded files
│
└─ Disk image (.img, .dd, .E01)
├─ fdisk/mmls → partition table
├─ fls -rd → deleted files
└─ mount -o ro,loop → search contents
Technique Reference Files
Load only the reference you need — don't read all at once.
| File |
Contents |
When to Load |
references/file-extraction.md |
Binwalk pipelines (standard, deep, Python), disk image analysis, metadata extraction |
Binary blobs, firmware, file carving, EXIF/metadata challenges |
references/memory-network.md |
Volatility v2/v3 chains, targeted extraction, process dump, PCAP reconstruction, DNS exfil |
Memory dumps, network forensics, packet analysis |
references/steganography.md |
Image stego workflow, Python LSB (all channels/bits), audio stego |
Hidden data in images or audio files |
Common Pitfalls
- Wrong Volatility profile — always run
imageinfo first; wrong profile = garbage output
- Binwalk misses files — try
foremost and scalpel as fallbacks; also check entropy for encrypted sections
- Steghide needs password — try empty string first (
-p ""), then common passwords, then brute-force with stegcracker
- PCAP too large — filter with display filters before export;
tshark -Y "http" to narrow scope
- LSB extraction wrong channel — always try R, G, B individually AND combined RGB; also try 2-bit planes
Examples
Example 1: Firmware → Hidden Filesystem → Flag
binwalk -eM firmware.bin
# Found SquashFS at offset 0x40000
cd _firmware.bin.extracted/squashfs-root/
find . -name "*flag*" -o -name "*.txt" | xargs cat
grep -r "flag{" .
Example 2: Memory Dump → Browser Credentials
vol.py -f memdump.raw imageinfo # → Win7SP1x64
vol.py -f memdump.raw --profile=Win7SP1x64 pslist | grep -i "chrome\|firefox"
vol.py -f memdump.raw --profile=Win7SP1x64 filescan | grep -i "login\|password\|cookie"
# Dump the login data file, then use sqlite3 to read credentials
Example 3: PCAP DNS Exfiltration
tshark -r traffic.pcap -Y "dns.qry.name" -T fields -e dns.qry.name | sort -u
# Suspicious: hex-encoded subdomains of evil.com
# → Load references/memory-network.md for Python DNS decoder
1---2name: ctf-forensics-extraction3description: Digital forensics extraction pipelines for CTF challenges — binwalk, Volatility, PCAP, steganography, disk images, metadata. Lean skill with on-demand reference files.4---56# ctf-forensics-extraction78## When to Use910- Extracting embedded files from composite binaries or firmware11- Analyzing memory dumps with Volatility (process lists, credentials, network)12- Reconstructing TCP sessions and extracting files from PCAP captures13- Detecting steganographic payloads in images or audio14- Mounting disk images and recovering deleted files15- Analyzing file metadata (EXIF, PDF, Office XML)1617## Quick Start1819```bash20# Binwalk: extract all embedded files21binwalk -eM suspicious.bin2223# Volatility: identify profile + list processes24vol.py -f memory.dmp imageinfo25vol.py -f memory.dmp --profile=Win10x64 pslist2627# PCAP: extract HTTP objects28tshark -r capture.pcap --export-objects http,exported/2930# Image stego: quick LSB check31zsteg challenge.png 2>/dev/null | head -2032```3334## Forensics Decision Tree3536```37Challenge file received38│39├─ Binary blob / firmware / archive40│ ├─ binwalk -eM → recursive extract41│ ├─ foremost / scalpel → file carving42│ └─ Check entropy plot for encrypted sections43│44├─ Memory dump (.dmp, .raw, .mem)45│ ├─ Volatility: imageinfo → profile46│ ├─ pslist → pstree → suspicious processes47│ ├─ netscan → network connections48│ ├─ filescan + dumpfiles → recover files49│ └─ cmdscan / consoles → command history50│51├─ PCAP / network capture52│ ├─ tshark --export-objects → HTTP/SMB/TFTP files53│ ├─ scapy TCP stream reconstruction54│ └─ DNS exfiltration: subdomain → base64/hex decode55│56├─ Image / audio file57│ ├─ file + exiftool + strings → quick metadata58│ ├─ PNG/BMP: zsteg, LSB extraction59│ ├─ JPEG: steghide (try empty password)60│ ├─ Audio: spectrogram, SSTV, LSB61│ └─ binwalk → embedded files62│63└─ Disk image (.img, .dd, .E01)64 ├─ fdisk/mmls → partition table65 ├─ fls -rd → deleted files66 └─ mount -o ro,loop → search contents67```6869## Technique Reference Files7071> **Load only the reference you need** — don't read all at once.7273| File | Contents | When to Load |74|------|----------|-------------|75| `references/file-extraction.md` | Binwalk pipelines (standard, deep, Python), disk image analysis, metadata extraction | Binary blobs, firmware, file carving, EXIF/metadata challenges |76| `references/memory-network.md` | Volatility v2/v3 chains, targeted extraction, process dump, PCAP reconstruction, DNS exfil | Memory dumps, network forensics, packet analysis |77| `references/steganography.md` | Image stego workflow, Python LSB (all channels/bits), audio stego | Hidden data in images or audio files |7879## Common Pitfalls8081- **Wrong Volatility profile** — always run `imageinfo` first; wrong profile = garbage output82- **Binwalk misses files** — try `foremost` and `scalpel` as fallbacks; also check entropy for encrypted sections83- **Steghide needs password** — try empty string first (`-p ""`), then common passwords, then brute-force with `stegcracker`84- **PCAP too large** — filter with display filters before export; `tshark -Y "http"` to narrow scope85- **LSB extraction wrong channel** — always try R, G, B individually AND combined RGB; also try 2-bit planes8687## Examples8889### Example 1: Firmware → Hidden Filesystem → Flag9091```bash92binwalk -eM firmware.bin93# Found SquashFS at offset 0x4000094cd _firmware.bin.extracted/squashfs-root/95find . -name "*flag*" -o -name "*.txt" | xargs cat96grep -r "flag{" .97```9899### Example 2: Memory Dump → Browser Credentials100101```bash102vol.py -f memdump.raw imageinfo # → Win7SP1x64103vol.py -f memdump.raw --profile=Win7SP1x64 pslist | grep -i "chrome\|firefox"104vol.py -f memdump.raw --profile=Win7SP1x64 filescan | grep -i "login\|password\|cookie"105# Dump the login data file, then use sqlite3 to read credentials106```107108### Example 3: PCAP DNS Exfiltration109110```bash111tshark -r traffic.pcap -Y "dns.qry.name" -T fields -e dns.qry.name | sort -u112# Suspicious: hex-encoded subdomains of evil.com113# → Load references/memory-network.md for Python DNS decoder114```
zebbern