CTF stego methodology

0. CRITICAL — never Read an unvalidated image

Per CLAUDE.md: reading a corrupt image poisons the conversation. Validate first:

bash
1run_tool("file", "/path/to/image")
2run_tool("identify", "/path/to/image")     # ImageMagick
3# or run_script:
4# from PIL import Image; img = Image.open(path); print(img.size, img.mode)

Only Read the image after both checks pass.

1. Triage every input

bash
1file <file>
2xxd <file> | head -30
3exiftool <file>            # metadata — flag often hides here
4strings <file> | grep -i "ctf\|flag\|key\|pass" | head
5binwalk <file>             # multi-file polyglots

Always check metadata first. ~30% of intro stego is just exiftool.

2. Image (PNG / JPG / BMP / GIF)

bash
1# zsteg covers most LSB cases for PNG/BMP
2zsteg -a image.png
3
4# steghide brute (jpg/wav/bmp)
5stegseek image.jpg rockyou.txt
6
7# Multi-tool sweep
8stegsolve image.png        # GUI, manual layer toggle

3. Audio (WAV / MP3 / FLAC / OGG)

bash
1# Spectrogram via sox
2sox audio.wav -n spectrogram -o spec.png
3# Then validate spec.png before reading (see step 0)
4
5# DTMF
6multimon-ng -a DTMF audio.wav

4. Video / GIF

bash
1# Extract frames
2ffmpeg -i video.mp4 -vf fps=1 frames/frame_%04d.png
3
4# Per-frame stego
5for f in frames/*.png; do zsteg -a "$f" 2>/dev/null | grep -i "flag\|ctf"; done
6
7# Audio track
8ffmpeg -i video.mp4 -vn audio.wav
9# Then audio analysis

5. Text / Unicode

bash
1# Show every character including invisibles
2python3 -c "import sys; [print(repr(c), hex(ord(c))) for c in open(sys.argv[1]).read()]" file.txt

6. Less common

• PDF: pdf-parser, peepdf, qpdf --qdf — check streams, annotations, JS, attachments
• Office docs: oletools (olevba, oleid), oledump, unzip the .docx/.xlsx
• QR / barcode: zbarimg, zxing — also try partial QR reconstruction
• DNA/protein sequences: ROT/encoding tricks, decode A/C/G/T as base-4

7. Default workflow

1. exiftool + strings + binwalk -e always first
2. If image → zsteg -a (PNG/BMP) OR stegseek (JPG)
3. If audio → spectrogram view
4. If nothing obvious → stegsolve GUI for visual analysis
5. If still nothing → metadata might encode the answer (look at GPS, comment, software field)

8. Don't waste time on

• LSB scripts when zsteg exists
• Manually viewing spectrograms in matplotlib when audacity/sonic-visualiser exist
• Reading the image with Read before validation (see step 0)

After solve

Use the writeup-template skill.