file format verification : file
view metadata : exiftool
, exiv2
extract some data : strings
, cat
, bgrep
More detail about image : stegoveritas
PNG image : zsteg
JPG/JPEG image : jsteg
zsteg
sometimes reveal hidden image.
Syntax : zsteg -E <method> hidden_image.png > reveal_img.png
Ref : https://szymanski.ninja/en/ctfwriteups/2021/shellctf/hidden-inside-2/
Tools : binwalk
, dd
, foremost
, steghide
Sometimes a file seems bigger than actual file size because it conceals another file to host file to avoid detect.
binwalk
can show in decimal and hexadecimal value of location to extract.
Use -e
flag to extract automatically.