Initial Analysis

file format verification : file

view metadata : exiftool, exiv2

extract some data : strings, cat, bgrep

More detail about image : stegoveritas


LSB Check

PNG image : zsteg

JPG/JPEG image : jsteg

zsteg sometimes reveal hidden image.

Syntax : zsteg -E <method> hidden_image.png > reveal_img.png

Ref : https://szymanski.ninja/en/ctfwriteups/2021/shellctf/hidden-inside-2/


File Carving

Tools : binwalk, dd, foremost, steghide

Sometimes a file seems bigger than actual file size because it conceals another file to host file to avoid detect.

binwalk can show in decimal and hexadecimal value of location to extract.

Use -e flag to extract automatically.