Steganography - Mirtia/Forensics-Journal GitHub Wiki

Steganography

I don't know if including Steganography in Forensics is correct, but I decided to write something down anyway.

Tools

OpenCV

Some basic scripts that may be useful for manipulating channels, xoring images, etc.

Xoring images

import cv2
    .
    .
    .
    img_1 = cv2.imread(args[0])
    img_2 = cv2.imread(args[1])
    img_xor = cv2.bitwise_xor(img_1, img_2)

    cv2.imshow('XOR Image', img_xor)
    cv2.waitKey(0)
    cv2.destroyAllWindows()

Remove R channel from image

import cv2
    .
    .
    .
    img = cv2.imread(args[0])
    b, g, r =  cv2.split(img)
    edited_img = cv2.merge([b, g, np.zeros_like(r)])
    cv2.imwrite("edited_image.jpg", edited_img)

pillow

An example of pillow library usage can be seen in this Writeup.

PDF

peepdf

pip install peepdf==0.3.2

.docx Macros

One word, oletools. Install via pip.

# extract macros
olevba -c /path/to/doc

stegsolve

Get stegsolve.

  • Try out filters
  • Analyze → Data Extract (to extract specific channels)

exiftool

# show metadata
exiftool <your_file_here>
exiftool <your_file_here> -a
exiftool -G -GPSAltitude -a <your_file_here>

zsteg

zsteg <your_file_here>
# extraction
zsteg -E "b1,rgb,msb,xy" <your_file_here> > <output_file>

steghide

steghide extract –sf <your_file_here>

openstego

Download here.

imagemagick

# https://legacy.imagemagick.org/script/convert.php
convert <source_file> -resize 50% M <dest_file>
identify <your_file_here>
identify -verbose <your_file_here>

Honorable Mentions

  • Rick GOAT Very useful and detailed information about a variety of stego tools.
⚠️ **GitHub.com Fallback** ⚠️