steganography

Steganography is a technique that consists of embedding secret information in a message. The goal is to prevent an unauthorized party (attacker) from knowing that secret information is concealed within the apparent message. The hidden information can be embedded in various communication channels, such as an image, a text, a song, a video, or even an object.

Steganography differs from encryption in that, with encryption, the attacker knows the message is encrypted—indicating that information is hidden—but cannot access it.

The tools listed below use predefined steganography techniques and frameworks to extract information from digital formats.

Online Tools

Depending on the sensitivity of the message one is analyzing for steganographic content, a good practice can be to use online tools. The following online resources can be useful:

• Aperisolve: Can also be used in CLI with the command:

  sudo sh -c "$(curl -fs https://www.aperisolve.com/install.sh)"

• StegOnline

Metadata

Metadata provides information used to describe a digital format. Common tools to analyze metadata include:

file <FILE>
exiftool <FILE>

Embedded Data Extraction

To search for hidden embedded data, the following commands can be used:

strings <FILE> | grep <FLAG>
strings <FILE> | awk 'length($0)>20' | sort -u
binwalk -Me <FILE>
stegseek -wl <WORD LIST> <FILE>

Bit Manipulation

For examining potentially corrupted or tampered files, a hex editor can be useful.

hexeditor <FILE>