Steganography is the practice of hiding data inside another file, such as an image, audio clip or document, so that its existence is not obvious. It differs from encryption, which makes a message unreadable but visible. In a CTF the hidden data is the flag.
Example
You receive holiday.jpg. file says it is a JPEG, but binwalk reports a ZIP archive appended after the image data. You extract it, find a text file and read the flag. Another common trick hides bits in the least significant bit of each pixel, which zsteg can read from a PNG.
Checks in order
fileandexiftoolfor type and metadata.stringsfor plain text.binwalkfor embedded files.steghide,zstegor a spectrogram for audio and images.
Check metadata before reaching for heavy tools; many flags are sitting in a comment field. Decode any strange string with the encoder and decoder.
On CTF7
Stego challenges are file attachments. Organizers set the flag and format, and can add hints that unlock for a cost. When a file must stay identical for every team, the flag is static; instance-based challenges can use per-team dynamic flags instead.
Learn more
Read the steganography guide for worked examples and tools, or browse all CTF guides.
Related terms
Browse the full CTF and cybersecurity glossary for more terms.
