Steganography

Basic File Inspection and Metadata Analysis

Extracts printable strings of at least 10 characters, useful for spotting hidden text or clues

strings -n 10 <filename>

Useful for viewing the end of files where hidden data might be appended:

tail

Extracts metadata from files

exiftool <filename>

Extraction Tools

Extracts hidden data from files using steghide:

steghide extract -sf <file>

Analyzes and extracts embedded files and firmware from images and binaries

binwalk -e <file>

Crack Passphrases

stegseek [stegofile.jpg] [wordlist.txt]

File carving tool that can recover files based on headers, footers, and data structures.

foremost

LSB (Least Significant Bit)

The least significant bit is the very last bit from binary sequence, which has the smallest impact on the overall value. Changing this bit usually causes a very tiny change in the data that’s often imperceptible to the human eye or ear.

• For example, in an 8-bit color value for a pixel, the least significant bit is the 8th bit

Tools like zsteg can automatically analyze PNG or BMP images for LSB steganography:

zsteg -a <filename>

Audio Steganography Analysis

Visualizes audio files to detect anomalies or hidden messages in the waveform or spectrogram:

sonic-visualizer