Data Smuggling, Encryption, Steganography, Etc
=====================================
ENCRYPTION
------Using Steghide------ steghide embed -ef secret.txt -cd image.jpg steghide extract -sf image.jpg
------Using Stegosuite------ stegosuite (GUI - open image, enter passphrase, embed/extract)
------Using Stegsnow------ stegnow -f secret.txt cover.txt stego.txt stegnow -x stego.txt extracted.txt cat extracted.txt
------Zip and encrypt w/ AES-256----- 7zip/WinRAR - Add To Archive, Encrypt with AES-256
-----Tool for searching binary images for embedded files and executable code----- binwalk - Linux
-----Embed a zip file into an image (polyglot)----- linux: cat IMAGE.png ZIP.zip > COMBINED.png windows: copy /b IMAGE.png+ZIP.zip COMBINED.png
-----To unzip embedded messages----- OPEN WITH 7ZIP OR WINRAR OR: 7z x PIC.PNG or unzip PIC.PNG or binwalk -e PIC.PNG
-----See/save hidden messages at bottom of images----- open w/ note++ NOTE: quick check to makes sure it "takes", not always reliable NOTE: Open file in Notepad++ and scroll to end — can sometimes reveal appended text
-----Hide images in sound; view with Audacity----- AudioPaint
-----Nts alternate data stream----- Notepad file.txt Notepad file.txt:hidden or echo test > file.txt:hidden type file.txt > file2.txt:hidden Details: notepad file.txt # normal file notepad file.txt:hidden # hidden stream (create/edit) type file.txt:hidden # read hidden data NOTE: Alternate Data Streams are not preserved if copied to FAT32/USB or sent over the internet (NTFS only).
-----WINDOWS HIDDEN/INVISIBLE FOLDER NAME----- Click F2 Alt 0160 (Then Set The Icon To A Blank PNG)
-----ALTERNATIVE TRANSMISSION----- SSTV - Slow Scan TV QSSTV - Linux VarAC over Ham Radio; w/ EmComm and RadioGateway;HF/FM/SAT | P2p EMS Comms [80,000 users in over 100 Countries] Requires Vara Modem Wifi Pumpkin SSTV Signal Generator by Scotty aka VE3NEA SSTV Tools [Bitmap Only] SSTV Signal Viewer by Scotty aka VE3NEA SSTV Tools SSTV Signal Denoiser by Scotty aka VE3NEA SSTV Tools
-----RENAME TO HIDE----- FILE.txt [rename to] FILE.png NOTE: Can be detected w/ file, exiftool, hex editor NOTE: Also mod the header NOTE: change EF BB BF in UTF-8 text to 89 50 4E 47 for PNG
-----DON'T FORGET----- ASCII HEXADECIMAL DECIMAL BINARY MORSE SEMAPHORE/FLAG MESSAGING L33tSp3@k SUBSTITUTION CIPHER/CAESAR CIPHER BUTTERFLY MAPPING MAD MAGAZINE FOLD MAPPING/MULTI IMAGE BREAK FADE/OPACITY ENCODING IN IMAGE MICRODOT ACRONYM SENTENCE CODING INTERLACED/OVERLAY/MESH CODING/VISUAL CRYPTOGRAPHY ONE-TIME PAD OVERLAY SECRET/HANDSHAKE CODING IMPLICATIVE LANGUAGE
=====================================
DECRYPTION
-----NTFS DATA STREAM----- streams.exe https://learn.microsoft.com/en-us/sysinternals/downloads/streams put streams.exe under c:\windows\system32\ streams file.txt
-----DETECT POLYGLOT----- LINUX: binwalk LINUX: binwalk -E FILE (entropy map) LINUX: hexdump -C | tail -10 LINUX: file FILE (detect true filetype vs extension) LINUX: exiftool FILE (metadata + filetype mismatch detection) WINDOWS: Format-Hex new.png | Select-Object -Last 10
-----BINWALK EXTRACT----- binwalk -e FILE open with 7zip/winrar
-----DETECT/EXTRACT STEGHIDE----- steghide info FILE.jpg (confirms steghide structure present, prompts passphrase) stegseek --seed FILE.jpg (fast structural confirmation, no passphrase needed) stegseek FILE.jpg /usr/share/wordlists/rockyou.txt (crack passphrase) stegcracker FILE.jpg (slower alternative to stegseek) steghide extract -sf FILE.jpg (extract if you have the passphrase)
-----DETECT LSB STEGANOGRAPHY (stegosuite, zsteg, etc)----- zsteg -a FILE.png (LSB analysis, PNG/BMP) stegdetect -t p FILE.jpg (statistical detection, JPEG) NOTE: install zsteg with: gem install zsteg
-----DETECT/EXTRACT STEGSNOW----- stegsnow -x stego.txt (extract without passphrase) stegsnow -C -x stego.txt (extract with compression flag) NOTE: stegsnow hides in whitespace — check .txt, .html files not just images
-----DETECT ANY STEG (batch/multi-tool)----- stegoveritas FILE.jpg (runs multiple detectors, dumps results) NOTE: pip install stegoveritas
-----ENTROPY ANALYSIS----- binwalk -E FILE (graph high entropy = possible hidden data)
-----OTHER----- AUDIO SPECTROGRAM HIDING (view with Audacity/Sonic Visualizer - spectrogram view) WHITESPACE STEGANOGRAPHY (stegsnow - trailing spaces/tabs in text files) METADATA HIDING (exiftool -Comment="hidden" FILE.jpg)
