Cheatsheet
Steganography decision tree
Fit
PNG
PDF
Steganography — where to look first
numbers = try in this order · hover for detail
ANY FILE
run first: file · exiftool · strings · binwalk
PNG / BMP
1
zsteg -a
LSB text / files
2
pngcheck -vtp7f
CRC / IHDR size
3
bit planes
all channels + MSB
4
data after IEND
carve the trailer
5
palette remap
indexed PNG
6
OpenStego
randomized LSB
JPEG
1
steghide -p ''
try empty pass
2
stegseek rockyou
crack passphrase
3
outguess / jsteg
jphide
4
stegdetect
statistical
GIF / APNG
1
extract frames
ffmpeg -vsync 0
2
frame durations
morse / binary
3
diff frames
consecutive
4
palette tricks
AUDIO
1
spectrogram FIRST
Audacity / sox
2
waveform
→ Morse
3
WAV LSB
stegolsb wavsteg
4
SSTV / DTMF / FSK
QSSTV / minimodem
5
steghide
DeepSound
VIDEO
1
ffprobe streams
count tracks
2
extract frames
ffmpeg -vsync 0
3
subtitle / attach
-map 0:s / dump
4
audio track
→ spectrogram
5
moov / trailing
exiftool · binwalk
TEXT
1
cat -A → stegsnow
whitespace
2
zero-width
U+200B / C / D
3
homoglyphs
mixed alphabets
4
encodings
CyberChef Magic
ARCHIVE / DOC
1
unzip / 7z
appended zip
2
binwalk -e
carve embedded
3
polyglot?
two magic bytes
4
pdf / docx / apk
it's a zip
5
fcrackzip -u -D
crack zip
PCAP / NET
1
tshark -qz io,phs
what's inside
2
--export-objects
carve HTTP/SMB
3
usb.capdata
keystrokes
4
dns.qry.name
exfil in subdomains
UNKNOWN / RAW
1
file / hex editor
identify
2
binvis.io
visualize bytes
3
raw import
GIMP / Audacity
4
QR / Braille
decode blob
Hover or tap a step for the command and details · drag to pan · scroll to zoom