Investigate image metadata
- Use command
file image.png
- Use command
exiftool image.png
- Use command
xxd image.png
- Use command
strings image.png
- Use tool binwalk to search binary images for embedded files and executable code:
binwalk image.png
- To extract the file:
binwalk -e image.png
- To extract the file:
- Use command:
steghide extract -sf image.png
- Steganographic Decoder
- Upload the file to it
- Bruteforce the password and extract contents of an image:
-
Use command
steghide info image.png
-
Inspect audio files (like
.wav
files) with Sonic Visualizer- Click on
Layer > Add Spectrogram
- Click on
- Now set the scale to dB^2 and the colour to White on Black
-
Try with the tool outguess when you have an image
- Also there is this other project (manteined) outguess
- Then, install it with:
./configure && make
- Then, try the command:
./outguess -r /file/to/analyze /path/to/the/output
-
If you find a corrupted image (checking the file header of the image which should be
\x89x50\x4Ex47
), the try this command:
- If you have two strings in different formats, try this python script:
- You also have the tool stegsolve
- Install with:
-
Use it with:
java -jar stegsolve.jar
-
You might also need to search for a web in WaybackMachine
-
Open
.pcap
files with wireshark and analyze them -
If you find a morse code on a
.wav
, try the tool morsecode decoder -
If you find an image and running
exiftool image.jpg
you find some zip: