Steganography CTF Writeup: Extract Flags from Images

Steganography CTF walkthrough: extract hidden data from PNG, JPEG, and WAV files using steghide, zsteg, LSB analysis, and spectral analysis.

Steganography challenges hand you an ordinary-looking image or audio file and dare you to find what’s hidden inside. The flag might be encoded in the least-significant bits of pixel color channels, appended as raw bytes after the file’s closing marker, tucked into EXIF comment fields, or painted into an audio spectrogram visible only when you view the frequency domain. This walkthrough takes you from the very first file command through every major steganography technique you’ll encounter in competition.

Challenge Setup

You receive a file — let’s call it challenge.png — and the prompt says nothing more than “find the flag.” That’s intentional. Part of the challenge is determining how the data is hidden before you can extract it. Resist the urge to jump straight to a single tool. Work through the reconnaissance phase first; it will tell you exactly which extraction technique to apply.

Audio Steganography

Audio files introduce a second hiding dimension: the frequency domain. While pixel-level hiding works in images, audio flags often appear as shapes drawn in the spectrogram — only visible when you view the file’s frequencies plotted over time.

Spectrogram Analysis

Open the WAV file in Audacity, then switch the track view to spectrogram mode. Go to the track name dropdown → Spectrogram. Zoom into the high-frequency range (8–22 kHz) where humans can’t hear well — that’s where authors like to draw text.

# Verify it's a valid WAV first
file audio.wav
exiftool audio.wav

# Open in Audacity (GUI)
audacity audio.wav

# Command-line spectrogram with sox
sox audio.wav -n spectrogram -o spectrogram.png
display spectrogram.png

In the spectrogram, look for:

• Text characters visible as bright patterns at specific frequencies
• Morse code patterns (short/long pulses visible as repeated vertical stripes)
• QR codes or bar codes rendered in the frequency domain

Adjust Audacity’s spectrogram color scheme to Roseus or Spectrum and crank the Gain and Range sliders for maximum contrast. Faint images that look like noise at default settings become clearly readable.

LSB in Audio

WAV files store uncompressed PCM samples — each sample is typically a 16-bit integer. LSB steganography replaces the least-significant bit of each sample with a payload bit. The audible difference is a tiny increase in noise floor, completely inaudible in practice.

import wave
import struct

def extract_lsb_audio(wav_path):
    with wave.open(wav_path, 'rb') as w:
        frames = w.readframes(w.getnframes())
        n_channels = w.getnchannels()
        sampwidth = w.getsampwidth()

    # Unpack 16-bit samples
    samples = struct.unpack('<' + 'h' * (len(frames) // 2), frames)
    bits = [str(s & 1) for s in samples]
    byte_strings = [''.join(bits[i:i+8]) for i in range(0, len(bits), 8)]

    message = []
    for b in byte_strings:
        val = int(b, 2)
        if val == 0:
            break
        message.append(chr(val))
    return ''.join(message)

print(extract_lsb_audio('audio.wav'))

Also try steghide on WAV files — it supports WAV in addition to JPEG and BMP:

steghide extract -sf audio.wav
steghide extract -sf audio.wav -p "password"

Tool Reference

PNG Toolkit

# Full zsteg scan
zsteg -a image.png

# Targeted extraction
zsteg image.png -b 1 -o xy -v
zsteg image.png -E "b1,rgb,lsb,xy" > payload

# Binwalk carving
binwalk -e image.png
foremost -i image.png -o ./out/

# Steghide extraction
steghide extract -sf image.jpg
steghide extract -sf image.jpg -p "password"
steghide info image.jpg

# Brute force password
stegseek image.jpg /usr/share/wordlists/rockyou.txt

# EXIF deep dive
exiftool -all image.jpg
exiftool -b -ThumbnailImage image.jpg > thumb.jpg

# Spectrogram to PNG
sox audio.wav -n spectrogram -o spec.png

# Steghide on WAV
steghide extract -sf audio.wav

# File structure check
file audio.wav
binwalk audio.wav
strings audio.wav | grep -i flag

Online steganography decoders exist and are tempting shortcuts, but they log your uploads. Never submit challenge files — which may contain sensitive competition data — to third-party websites. Run all analysis locally.