Lesson pack 8 · Core · 90 minutes
Steganography
Sweep an image, audio file, or paragraph for hidden data across the whole technique space rather than guessing one method.
Print this page for a paper plan - the navigation and links drop out.Student-facing version
Before the session
- Nothing to install. Students need a browser and https://ctfpal.com. Confirm the room can reach it once; after that it works offline.
- Read the lesson yourself first - about 7 minutes.
- Have one worked example ready to paste. The classroom link builder on the instructor page turns it into a URL that opens preloaded.
Objectives
Written as things a student can do afterwards, so they can be assessed rather than asserted.
- Extract LSB data across channels, bit orders, and traversal directions
- Read a spectrogram to distinguish painted text, Morse, SSTV, and DTMF
- Detect zero-width and whitespace steganography in plain text
- Explain why LSB survives in PNG and dies in JPEG
Running order (90 min)
| Time | What happens |
|---|---|
| 0:00-0:09 | Frame the problemWhat the category looks like when you meet it cold, and why the naive approach fails. |
| 0:09-0:27 | Teach the methodThe technique itself, on the board or from the lesson. No tools open yet. |
| 0:27-0:50 | Demonstrate liveSame technique, in the workspace, on your worked example. Narrate every choice. |
| 0:50-1:21 | Practice setStudents work the challenges. Circulate rather than present. |
| 1:21-1:30 | Checkpoint and wrapCollect the artefact, name what comes next. |
Tools used
- Automatic steganography solver - Throw every applicable steganography technique at a file at once - image, audio, archive, text, and document - recursively unpack what falls out, and surface flag matches.https://ctfpal.com/?tool=stego-solver
- LSB steganography extractor - Extract least-significant-bit data from images across every channel, bit order, and traversal direction, with bit-plane visualisation.https://ctfpal.com/?tool=lsb-steganography
- Audio spectrogram and SSTV decoder - View a WAV as a spectrogram to find text drawn in frequency space, decode Morse and SSTV, and extract LSB data from audio samples.https://ctfpal.com/?tool=audio-spectrogram
- Zero-width character and text steganography decoder - Reveal messages hidden in zero-width Unicode characters, trailing whitespace, and homoglyph substitution - text steganography that survives copy-paste.https://ctfpal.com/?tool=zero-width-decoder
Reading
- A workflow for image steganography, from magic bytes to bit planes - 7 min. Stego challenges reward order, not inspiration. The sequence that finds the payload: container checks before pixel checks, structure before statistics, and the specific tells that separate a PNG trick from a JPEG one.
Practice set
Real picoCTF challenges tagged with this module’s techniques, easiest first. Assign the first three in class and the rest as homework.
- Flag in Flame - picoMini by CMU-Africa, easy
- Glory of the Garden - picoCTF 2019, easy
- Hidden in plainsight - picoMini by CMU-Africa, easy
- Ph4nt0m 1ntrud3r - picoCTF 2025, easy
- RED - picoCTF 2025, easy
- Secret of the Polyglot - picoCTF 2024, easy
- StegoRSA - picoCTF 2026, easy
- FindAndOpen - picoCTF 2023, medium
- flags are stepic - picoCTF 2025, medium
- hideme - picoCTF 2023, medium
- HideToSee - picoCTF 2023, medium
- MacroHard WeakEdge - picoCTF 2021, medium
Checkpoint (gradeable)
Solve a nested stego challenge and draw the chain of containers from the outermost file to the flag.
Deliberately a produced artefact rather than a quiz question: it is either there or it is not, which makes it fast to mark and hard to bluff. Every tool in ctfpal is deterministic, so two students who did the work correctly hand in the same value.
Where the room gets stuck
Steganography rewards breadth, which makes it the module where an automated sweep is most obviously better than a hypothesis. Use it to teach that a broad cheap search beats a narrow expensive guess.
If you finish early
- Hand out a challenge from the cross-CTF index in this category - each one has published solutions to compare afterwards.
- Run the same input through Identify and let the class argue with the ranking. Disagreeing with a confidence score is where the technique actually lands.
- Ask a student to break their own example - construct an input that defeats the tool, and explain why.