Steganography
Sweep an image, audio file, or paragraph for hidden data across the whole technique space rather than guessing one method.
By the end you can
- Extract LSB data across channels, bit orders, and traversal directions
- Read a spectrogram to distinguish painted text, Morse, SSTV, and DTMF
- Detect zero-width and whitespace steganography in plain text
- Compare a suspect image against an original, perceptually and byte for byte, and say what the difference means
- Explain why LSB survives in PNG and dies in JPEG
1. Read
A workflow for image steganography, from magic bytes to bit planes
Stego challenges reward order, not inspiration. The sequence that finds the payload: container checks before pixel checks, structure before statistics, and the specific tells that separate a PNG trick from a JPEG one.
Audio steganography: spectrograms, LSB, and signals that are not music
A layered workflow for audio challenges - what the waveform tells you, why the spectrogram is almost always the first move, decoding DTMF and SSTV and Morse, and the LSB and metadata tricks that hide in a WAV.
Hiding in text: zero-width characters, homoglyphs, and whitespace
A paragraph that looks ordinary and carries a payload. How to detect zero-width and bidirectional control characters, spot a Cyrillic letter posing as a Latin one, read whitespace encodings, and recover the bits.
2. Use the tools
In the order they come up while solving. Read what each one does, or go straight to the workspace tab that runs it.
- Automatic steganography solver
Throw every applicable steganography technique at a file at once - image, audio, archive, text, and document - recursively unpack what falls out, and surface flag matches.
Open it in the workspace - LSB steganography extractor
Extract least-significant-bit data from images across every channel, bit order, and traversal direction, with bit-plane visualisation.
Open it in the workspace - PNG chunk analyzer
Walk a PNG chunk by chunk, validate CRCs, read tEXt and zTXt metadata, and find data hidden after IEND or in non-standard chunks.
Open it in the workspace - Audio spectrogram and SSTV decoder
View a WAV as a spectrogram to find text drawn in frequency space, decode Morse and SSTV, and extract LSB data from audio samples.
Open it in the workspace - DTMF tone decoder
Decode telephone keypad tones from audio - the dual-frequency pairs that encode digits 0-9, *, #, and A-D.
Open it in the workspace - Morse code translator
Translate Morse code to text and back, tolerating any dot/dash characters and any word separator. Also decodes Morse recovered from audio.
Open it in the workspace - Zero-width character and text steganography decoder
Reveal messages hidden in zero-width Unicode characters, trailing whitespace, and homoglyph substitution - text steganography that survives copy-paste.
Open it in the workspace - Perceptual image hash: are these the same picture?
Compare two images by aHash, dHash and pHash in the browser - a re-encoded, resized or recompressed copy has a different checksum and nearly the same perceptual hash.
Open it in the workspace
3. Try one now
Generated in your browser and checked in your browser. No account, nothing to download, and a fresh one whenever you want another.
4. Practise on the real thing
Real picoCTF challenges that use these techniques, easiest first. 32 match in total - see the full index.
Common mistakes
The wrong turns this topic reliably produces. Written as the mistake rather than the rule, because the rule is easy to agree with and easy to walk straight past.
- Trying one extraction and concluding there is nothing there. LSB alone has channel, bit-plane, bit-order and traversal variants, and the sweep exists because guessing which is expensive.
- Looking for LSB in a JPEG. Lossy recompression destroys it, so a JPEG challenge is almost always metadata, appended data, or the spectrogram.
- Ignoring the text. Zero-width characters and trailing whitespace survive copy-paste, and nothing about the rendered page shows them.
- Starting the sweep before identifying the container. An LSB pass over what turns out to be an archive wearing a PNG header costs the whole session, and the previous module answers that question in one command.
- Reading a passphrase prompt as a dead end. These tools take a key, and the key is almost always elsewhere in the challenge - the filename, the metadata, the accompanying text - rather than something to brute force.
Checkpoint
Solve a nested stego challenge and draw the chain of containers from the outermost file to the flag.
Teaching note
Steganography rewards breadth, which makes it the module where an automated sweep is most obviously better than a hypothesis. Use it to teach that a broad cheap search beats a narrow expensive guess.
Go deeper
The lessons above are written to get you through a challenge. These go after the subject instead. Each one opens our notes on that chapter - what it argues, what to take from it and where it stops - so this is somewhere to read now rather than a book to buy first. Nothing here is affiliate-linked or sold by us.
Chapter 13, Hiding Data with Steganography
Black Hat Go - Tom Steele, Chris Patten, and Dan Kottmann
Writing the embedder makes the extraction parameters obvious, because you had to choose them.
Chapter 16, Encoding and Encryption
Evasive Malware - Kyle Cucci
The same hiding techniques used for payload delivery, where the goal is evading a scanner rather than a player.
Every book the curriculum cites has a page in the library.