By Davy Rogers. Use these techniques only in environments you own or have explicit permission to test.

What is Steganography

Steganography is the art and science of hiding secret information within ordinary, non-secret data. Unlike encryption, which makes data unreadable, steganography makes the very existence of the data invisible. The word comes from Greek: steganos (covered) + graphein (writing) = "covered writing." In cybersecurity and CTF competitions, steganography is a crucial skill for hiding and discovering hidden messages.

What You'll Learn

  • What steganography is and how it differs from cryptography
  • Common steganography techniques
  • Tools for hiding and extracting hidden data
  • Image, audio, and video steganography
  • Detection methods (steganalysis)
  • Real-world applications and CTF challenges

Steganography vs. Cryptography

Both protect information, but in fundamentally different ways:

Cryptography

  • Makes data unreadable (transforms plaintext → ciphertext)
  • Obvious that security is being used (encrypted data looks random)
  • Attracts attention - "What are you hiding?"
  • Example: 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8

Steganography

  • Hides the existence of data (secret message within innocent-looking file)
  • No indication that anything is hidden (looks like a normal image/file)
  • Avoids suspicion - "Nothing to see here"
  • Example: A vacation photo that secretly contains a confidential document

Best of Both Worlds

Encrypt first, then hide: Maximum security

Plaintext → Encryption → Ciphertext → Steganography → Innocent-looking file

Historical Examples

Ancient Techniques

1. Invisible Inks

  • Lemon juice, milk, urine (visible when heated)
  • Used by Revolutionary War spies

2. Wax Tablets

  • Ancient Greece: Write on wood, cover with wax, write innocent message on wax
  • Herodotus documented this in 440 BCE

3. Shaved Heads

  • Write message on slave's shaved head
  • Wait for hair to grow back
  • Send slave as messenger

4. Microdots

  • Reduce a page of text to the size of a period (.)
  • Used extensively in WWII espionage

Modern Examples

Operation Steganography (Al-Qaeda)

  • 9/11 terrorists allegedly hid operational plans in images posted online

SUNBURST Supply Chain Attack (2020)

  • SolarWinds breach used steganography in command-and-control communications

Stuxnet Worm (2010)

  • Used steganographic techniques to hide malicious code

Common Steganography Techniques

1. Least Significant Bit (LSB) Insertion

The most common technique for image steganography.

How It Works:

Digital images store color values as numbers. Changing the last bit barely affects the visible image but can store data.

Original pixel (red channel): 11010110 (decimal 214)
Modified pixel (red channel): 11010111 (decimal 215)
                                    ↑
                           Hidden bit: 1

Visual difference: Imperceptible to human eye!

Example: Hide "Hi" in an image

'H' in binary: 01001000
'i' in binary: 01101001

Need 16 pixels (each stores 1 bit in its LSB):
Pixel 1: ...0  →  Store: 0
Pixel 2: ...1  →  Store: 1
Pixel 3: ...0  →  Store: 0
...and so on

Capacity: 1 byte per 8 pixels (BMP), less for compressed formats

2. Masking and Filtering

  • Uses image processing techniques to hide data
  • More robust than LSB (survives compression)
  • Modifies luminance of specific areas

3. Algorithms and Transformations

  • DCT (Discrete Cosine Transform): Used in JPEG compression
  • DWT (Discrete Wavelet Transform): More robust
  • Spread Spectrum: Spreads hidden data across frequency spectrum

4. Metadata Embedding

Hide data in file metadata (EXIF data, comments, etc.)

# Images store metadata
exiftool image.jpg
# Can hide data in comments, copyright fields, etc.

5. Whitespace Steganography

Hide data in:

  • Extra spaces at end of lines
  • Tabs vs. spaces
  • Line breaks
This text looks normal.[SPACE][SPACE]
But extra spaces hide a message.[SPACE]
Each line encodes 1 or 0.[SPACE][SPACE][SPACE]

Image Steganography

BMP (Bitmap)

  • ✅ Uncompressed - perfect for LSB
  • ✅ Simple format
  • ❌ Large file size

PNG (Portable Network Graphics)

  • ✅ Lossless compression
  • ✅ Good for steganography
  • ✅ Supports transparency (alpha channel = extra space!)

JPEG/JPG

  • ⚠️ Lossy compression damages LSB data
  • ⚠️ More complex to implement
  • ✅ Common format (less suspicious)

GIF

  • ⚠️ Limited colors (256 max)
  • ⚠️ Compression issues
  • ✅ Animation frames can hide data

Tools for Image Steganography:

Steghide 🥇

# Hide secret.txt in image.jpg
steghide embed -cf image.jpg -ef secret.txt -p mypassword

# Extract hidden data
steghide extract -sf image.jpg -p mypassword

# Get info without extracting
steghide info image.jpg

StegOnline

Web-based tool: stegonline.georgeom.net

  • LSB visualization
  • Bit plane analysis
  • Multiple extraction methods

zsteg (PNG & BMP)

# Install
gem install zsteg

# Auto-detect hidden data
zsteg image.png

# Extract LSB data
zsteg -a image.png

# Specific extraction
zsteg -E "b1,rgb,lsb,xy" image.png

Stegsolve (Java tool)

  • Visual analysis of images
  • Bit plane viewer
  • Frame browser for animated images
  • Stereo analysis
# Download and run
java -jar stegsolve.jar
# Then: File > Open > Analyze

Exiftool

# View all metadata
exiftool image.jpg

# Look for suspicious data
exiftool image.jpg | grep -i comment
exiftool image.jpg | grep -i copyright

# Extract thumbnail (sometimes contains hidden data)
exiftool -b -ThumbnailImage image.jpg > thumb.jpg

Binwalk

Searches for embedded files within files:

# Install
sudo apt install binwalk

# Scan for embedded files
binwalk image.jpg

# Extract embedded files
binwalk -e image.jpg

Audio Steganography

Techniques:

1. LSB in Audio Samples

  • Similar to images, modify least significant bits
  • WAV files work best (uncompressed)

2. Phase Coding

  • Modify phase of audio signal
  • Inaudible to humans

3. Echo Hiding

  • Add imperceptible echoes
  • Echo pattern encodes data

4. Spread Spectrum

  • Spread data across frequency spectrum
  • Very robust

Tools:

# Steghide works with WAV files too
steghide embed -cf audio.wav -ef secret.txt

# DeepSound (Windows GUI tool)
# Can hide files in FLAC, MP3, APE, WAV

Video Steganography

Video = Sequence of images + audio + metadata = LOTS of hiding places!

Techniques:

  • Hide data in frames (LSB on each frame)
  • Hide in motion vectors
  • Audio steganography within video
  • Container metadata

Tools:

  • OpenPuff - Supports video formats
  • StegoStick - Video steganography
  • FFmpeg - Can manipulate video at low level

Text Steganography

Techniques:

1. Whitespace

# Encode message in spaces/tabs
"Hello World[SPACE][SPACE]"  # 00
"Secret[SPACE][TAB]"          # 01

2. Unicode Characters

Use invisible Unicode characters:
Zero-Width Space (U+200B)
Zero-Width Non-Joiner (U+200C)
Zero-Width Joiner (U+200D)

3. Font/Size/Color Variations

<span style="color:#000000">Normal text</span>
<span style="color:#000001">Contains hidden bit</span>
<!-- Human eye can't see #000000 vs #000001 -->

4. Sentence Structure

  • First letter of each word spells message
  • Every 5th word contains information

File System Steganography

Slack Space

Unused space in disk sectors:

File is 1000 bytes, but sector size is 4096 bytes
= 3096 bytes of slack space available!

Alternate Data Streams (NTFS)

Windows NTFS feature:

# Create file with hidden stream
echo "secret data" > file.txt:hidden

# Normal view shows nothing
type file.txt
# (empty)

# Access hidden stream
more < file.txt:hidden
# secret data

# List streams
dir /r

Hidden Partitions

  • Create encrypted partitions within free space
  • Tools: VeraCrypt hidden volumes

Detecting Steganography (Steganalysis)

Statistical Analysis

Chi-Square Test

  • Measures deviation from expected distribution
  • LSB insertion creates statistical anomalies

Histogram Analysis

  • Compare color distribution
  • Look for unusual patterns

Visual Analysis

Bit Plane Slicing

  • View individual bit planes
  • Hidden data often visible in LSB plane
# StegOnline can visualize bit planes
# Upload image > Browse Bit Planes

File Analysis

# Compare file sizes
ls -lh original.png stego.png
# Stego file might be slightly larger

# Check for anomalies
file image.jpg
exiftool image.jpg
hexdump -C image.jpg | less

# Look for embedded files
binwalk image.jpg
foremost -i image.jpg  # File carver

Tools for Detection:

StegExpose

# Install
git clone https://github.com/b3dk7/StegExpose.git

# Scan for steganography
java -jar StegExpose.jar image.jpg

Stegdetect

# Detect steghide, jphide, etc.
stegdetect image.jpg

CTF Steganography Challenges

Common CTF Techniques:

  1. LSB Steganography

    • Use zsteg, stegsolve

  2. Hidden Files

    • Use binwalk, foremost

  3. EXIF Data

    • Use exiftool

  4. Password-Protected

    • Brute force with rockyou.txt

  5. Multiple Layers

    • Image contains encrypted text
    • Text is base64 of another image
    • That image contains the flag

CTF Workflow:

# 1. File identification
file challenge.jpg

# 2. Metadata analysis
exiftool challenge.jpg

# 3. Strings search
strings challenge.jpg | grep -i flag

# 4. Binwalk scan
binwalk challenge.jpg

# 5. Steg tool scan
zsteg challenge.jpg
steghide extract -sf challenge.jpg

# 6. Visual analysis
stegsolve challenge.jpg

# 7. Check for hidden files
binwalk -e challenge.jpg
foremost -i challenge.jpg

Practical Examples

Example 1: Hide Text in Image

# Create secret message
echo "FLAG{this_is_secret}" > secret.txt

# Hide in image
steghide embed -cf vacation.jpg -ef secret.txt -p password123

# Share vacation.jpg (looks normal!)

# Recipient extracts
steghide extract -sf vacation.jpg -p password123
cat secret.txt

Example 2: Hide File in Image

# Hide entire ZIP archive in image
steghide embed -cf photo.png -ef confidential.zip

# Or manually append (simple but detectable)
cat photo.png confidential.zip > stego.png

# Extract
binwalk -e stego.png

Example 3: NTFS Alternate Data Streams

# Hide password file
echo "admin:password123" > passwords.txt:hidden

# File appears empty
type passwords.txt

# Access hidden data
more < passwords.txt:hidden

Real-World Applications

Legitimate Uses:

  1. Digital Watermarking - Copyright protection
  2. Authentication - Embed signatures in documents
  3. Covert Communication - Journalists in oppressive regimes
  4. Data Integrity - Tamper detection

Malicious Uses:

  1. Data Exfiltration - Steal data without detection
  2. Command and Control - Hide C2 traffic in images
  3. Malware Distribution - Hide malware in innocent files
  4. Evading Detection - Bypass DLP (Data Loss Prevention) systems

Defensive Measures:

  1. Inspect outbound files - Automated steganalysis
  2. Monitor file uploads/downloads - Unusual patterns
  3. Baseline normal traffic - Detect anomalies
  4. Restrict file types - Block unnecessary formats

Try It Yourself

Beginner Challenge:

Task 1: Hide a secret message in an image

# Download any image
wget https://picsum.photos/800/600 -O test.jpg

# Create secret
echo "You found me!" > secret.txt

# Hide it
steghide embed -cf test.jpg -ef secret.txt -p ctf2025

# Extract it
steghide extract -sf test.jpg -p ctf2025

Task 2: Find the hidden message

# I've hidden text in this image: [instructor provides image]
# Try these tools:
strings image.jpg
exiftool image.jpg
zsteg image.png
binwalk image.jpg

Task 3: Whitespace steganography

# Encode binary message in spaces (1 space = 0, 2 spaces = 1)
text = "Hello World"
binary = "01001000"  # 'H' in binary

# Write code to hide binary in trailing spaces

Common Pitfalls

❌ Using steganography without encryption ✅ Always encrypt data before hiding

❌ Reusing the same carrier file ✅ Use different files to avoid pattern detection

❌ Forgetting passwords ✅ Document your steganography method

❌ Using obvious file names ✅ vacation.jpg not stego_container.jpg

❌ Not testing extraction ✅ Always verify hidden data is recoverable

Resources

Online Tools:

Software:

  • Steghide - CLI tool for images/audio
  • OpenStego - GUI tool (Java)
  • DeepSound - Audio steganography (Windows)
  • OpenPuff - Multiple format support

Practice:

Reading:

  • "Hiding in Plain Sight: Steganography and the Art of Covert Communication" by Eric Cole
  • SANS paper: "Steganography: An Overview"
  • "Digital Watermarking and Steganography" by Ingemar J. Cox

Next Steps

  1. Install tools: steghide, zsteg, exiftool, binwalk
  2. Practice: Hide messages in your own images
  3. CTF challenges: Try steganography challenges on PicoCTF
  4. Next lesson: Learn about red team operations and offensive security
  5. Explore: Try creating your own steganography script in Python

Remember: Steganography is like magic—the best tricks leave the audience wondering if anything even happened!

"The best place to hide a leaf is in a forest." - Ancient proverb (the essence of steganography)

Up next

What is a Red Team

Understanding offensive security and red team operations.