steganography-techniques

A detection-and-extraction playbook for uncovering data hidden inside images, audio, files, and text, organized by file type with tool-specific workflows. It suits forensics and CTF-style analysis and routes to related material for pulling files out of packet captures or memory dumps before analysis, and to cipher analysis when extracted payloads are further encoded. The method emphasizes a systematic, file-type-driven approach rather than ad hoc guessing.

Image coverage spans least-significant-bit analysis with zsteg, StegSolve, and the automated stegoveritas; PNG structure checks with pngcheck including hidden tEXt, zTXt, and iTXt chunks and the CRC-versus-dimensions crop trick that brute-forces width and height to reveal hidden rows; JPEG DCT hiding via steghide and jsteg; EXIF metadata inspection with exiftool; and GIF palette manipulation. Audio coverage includes spectrogram viewing in Sonic Visualiser and sox, audio LSB with WavSteg, DTMF and morse decoding via multimon-ng, SSTV image decoding, and WAV header size checks for appended data.

File-level techniques handle polyglots that are valid in multiple formats simultaneously, embedded-data discovery and carving with binwalk and foremost, manual dd extraction at known offsets, NTFS alternate data streams, and passphrase brute forcing against steghide with stegcracker or the much faster stegseek. Text steganography covers whitespace encoding decoded with stegsnow, zero-width Unicode characters, and homoglyph substitution. Throughout, the playbook pairs each hiding technique with the concrete tools and command patterns needed to detect and extract the payload.