Tools

Visualizes a binary file as a space-filling curve image, making repeated structure, embedded files, and anomalies visually obvious — useful both for RE triage and for spotting a likely stego carrier.

Hides a message inside a GIF by shuffling its colour palette order rather than touching pixel data, leaving the visible image completely unchanged.

gifshuffle -p "password" cover.gif out.gif secret.txt

Simple JPEG steganography tool for hiding and revealing data in the DCT coefficients of a JPEG file — a common CTF format that plain LSB-in-PNG tools do not handle.

jsteg reveal in.jpg out.txt

Extended attributes are an easy-to-overlook place to smuggle a small payload or marker outside a file normal content stream.

find / -xdev -exec getfattr -d {} \; 2>/dev/null | grep -B1 '^user\.'

Hides data inside an MP3 file during the compression process itself, rather than after encoding — a common source for CTF "hidden data in this audio file" challenges.

Open-source steganography tool for hiding data inside images and for invisible-watermark embedding, with both a GUI and a CLI.

Universal steganographic tool that hides data in JPEG (and other) images while preserving the cover's statistical properties, making it harder to detect than naive LSB embedding.

outguess -k "key" -d hidden.txt cover.jpg stego.jpg

Validates a PNG file's chunk structure and reports corruption, unusual/nonstandard chunks or data appended after the IEND marker — a quick check before hunting for hidden data manually.

pngcheck -v suspicious.png

Whitespace steganography tool — hides a message in the trailing spaces and tabs at the end of text lines, invisible unless you go looking for it (or view the file with tabs shown).

snow -C -m "secret" cover.txt stego.txt

Audio analysis application with a detailed spectrogram view, the standard way to visually reveal a message or image hidden in an audio file's frequency content.

Encodes a hidden image or message into an audio file such that it only becomes visible as a spectrogram — the tool behind the "load the WAV in Sonic Visualiser" CTF trope.

python spectrology.py -i secret.png -o out.wav

Dictionary brute-forcer for steghide-protected files, wrapping steghide itself in a loop over a wordlist — Stegseek is the faster modern replacement for the same job.

stegcracker image.jpg rockyou.txt

Steganalysis tool that scores a set of PNG/BMP images for likely LSB steganography, useful for triaging which of many images in a CTF archive is worth digging into by hand.

java -jar StegExpose.jar images/

A steganography tool that hides data inside JPEG, BMP, WAV and AU files, with optional passphrase-based encryption — the classic CTF stego first-try.

steghide extract -sf image.jpg

Steganography toolkit that automates the usual checklist against an image — metadata, LSB extraction, bit-plane dumps, colour-channel splits, and running other steg tools for you.

stegoveritas.py image.png

Extremely fast steghide passphrase cracker (thousands of times faster than brute-forcing steghide itself) that tries an entire wordlist against a JPEG/BMP/WAV/AU carrier.

stegseek carrier.jpg rockyou.txt

Java GUI for stepping through bit planes, colour channels, palettes and frames of an image — the classic manual-inspection tool for image steganography before scripting anything.

java -jar stegsolve.jar

LSB steganography tool for hiding and extracting data in WAV audio files, part of a small suite alongside a matching PNG LSB tool.

python3 WavSteg.py -r -s cover.wav -o out.txt -n 2

Detects hidden data stashed in the low bits of PNG and BMP pixel data — the standard second stego check after steghide comes up empty on an image.

zsteg -a image.png