forked from nihilist/blog-contributions
228 lines
8.8 KiB
HTML
228 lines
8.8 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<meta name="description" content="">
|
|
<meta name="author" content="">
|
|
<link rel="shortcut icon" href="../../../../../../assets/img/favicon.png">
|
|
|
|
<title>Hiding files in images with steghide</title>
|
|
|
|
<!-- Bootstrap core CSS -->
|
|
<link href="../../assets/css/bootstrap.css" rel="stylesheet">
|
|
<link href="../../assets/css/xt256.css" rel="stylesheet">
|
|
|
|
|
|
|
|
<!-- Custom styles for this template -->
|
|
<link href="../../assets/css/main.css" rel="stylesheet">
|
|
|
|
|
|
|
|
<!-- HTML5 shim and Respond.js IE8 support of HTML5 elements and media queries -->
|
|
<!--[if lt IE 9]>
|
|
<script src="https://oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js"></script>
|
|
<script src="https://oss.maxcdn.com/libs/respond.js/1.3.0/respond.min.js"></script>
|
|
<![endif]-->
|
|
</head>
|
|
|
|
<body>
|
|
|
|
<!-- Static navbar -->
|
|
<div class="navbar navbar-inverse-anon navbar-static-top">
|
|
<div class="container">
|
|
<div class="navbar-header">
|
|
<button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
|
|
<span class="icon-bar"></span>
|
|
<span class="icon-bar"></span>
|
|
<span class="icon-bar"></span>
|
|
</button>
|
|
<a class="navbar-brand-anon" href="\index.html">nihilist`s Blog</a>
|
|
</div>
|
|
<div class="navbar-collapse collapse">
|
|
<ul class="nav navbar-nav navbar-right">
|
|
|
|
<li><a href="/about.html">About</a></li>
|
|
<li><a href="/blog.html">Categories</a></li>
|
|
<li><a href="https://blog.nowhere.moe/donate.html">Donate</a></li>
|
|
<li><a href="/contact.html">Contact</a></li>
|
|
</ul>
|
|
</div><!--/.nav-collapse -->
|
|
|
|
</div>
|
|
</div>
|
|
|
|
<!-- +++++ Posts Lists +++++ -->
|
|
<!-- +++++ First Post +++++ -->
|
|
<div id="anon2">
|
|
<div class="container">
|
|
<div class="row">
|
|
<div class="col-lg-8 col-lg-offset-2">
|
|
<h2><b>Basic Use</b></h2>
|
|
<a href="../index.html">Previous Page</a></br></br><p><img src="../../assets/img/user.png" width="50px" height="50px"> <ba>Zesc - 2024-08-30</ba></p>
|
|
<h1>Hiding files in images with steghide</h1>
|
|
|
|
<p>steghide is a mature GPL-licensed CLI tool for hiding arbitrary data inside of of image files (and some archaic audio formats). Its official web presence is located at <a href="https://steghide.sourceforge.net/">https://steghide.sourceforge.net/</a>, but it is ubiquitously mirrored in various repositories and package managers (<a href="https://github.com/StegHigh/steghide"></a>. If you use APT, simply install it with</p>
|
|
<pre><code class="nim"># apt install steghide
|
|
</code></pre>
|
|
|
|
<!-- <p>steghide conceals data inside a larger coverfile in a way that is indistinguishable to first-order statistical analysis. This means that without comparing to exact copy of your original coverfile, there are no anomalies to it.</p> -->
|
|
|
|
<p>steghide uses subcommands, and the three most important ones are <code>info</code>, <code>embed</code> and <code>extract</code> which will be explained in sequence. For this tutorial, we are going to use the <a href="https://apod.nasa.gov/apod/astropix.html">Astronomy Picture of the Day</a> of 2024-09-08, a beautiful image of the Andromeda galaxy:</p>
|
|
<img src="apod20240924.jpg" style="width:250px">
|
|
<p>Our example file to hide is going to be <a href="https://bitcoin.org/bitcoin.pdf">Bitcoin: A Peer-to-Peer Electronic Cash System</a>, the original paper by Satoshi Nakamoto.</p>
|
|
|
|
<p>As mentioned above, the cover image must be larger than the file you wish to embed, <b>as a rule of thumb your coverfile should be 20 times larger</b>. We can check how many bytes steghide can embed by using <code>steghide info <i>file</i></code>. In our case, it tells us that it can embed 232 KB and asks whether an attempt should be made at reading embed data without extracting. As there is nothing embedded yet, we decline with <kbd>n</kbd>.</p>
|
|
|
|
<pre><samp>"apod20240824.jpg":
|
|
format: jpeg
|
|
capacity: 232.6 KB
|
|
Try to get information about embedded data ? (y/n)
|
|
</samp></pre>
|
|
|
|
<p>The PDF is only 180 KB, so it fits. Next, we use <code>steghide embed -cf <i>coverfile</i> -ef <i>embedfile</i> -sf <i>destination</i></code> and get asked for a passphrase (make sure to remember it or safe it in a password manager). After re-entering the passphrase (you can set it beforehand with the <code>-p</code> option) it will write the processed file to the specified destination. You can also leave out the <code>-sf</code> option, in which case it defaults to overwriting the coverfile. Look at it and try to find a visual difference to the original:</p>
|
|
<img src="output1.jpg" style="width:250px">
|
|
<p>It's completely lost in the visual noise. As an experiment, let's try taking the difference of both images with a program like GIMP. This is what it looks like:</p>
|
|
<img src="difference.jpg" style="width:250px">
|
|
|
|
<p>A difference of zero means a fully black pixel. Try zooming in and you'll see that only a few pixels are slightly lighter than black. These are the pixels that contain parts of your embedded file.</p>
|
|
|
|
<div><b>WARNING: changing the output file in anyway will make the embedded file irretrievable. This is especially important for every form of lossy compression!</b></div>
|
|
|
|
<p>Now let's try to extract the file we've just hid. For this, use <code>steghide embed -sf <i>input</i></code></p>. This will prompt you for the passphrase. Enter it, and the contents will be extracted into the working directory. In our case we will be asked whether we want to overwrite the file with the same name that already exists. (You can suppress this warning with <code>-f</code> or by specifying an alternative output destination with <code>-xf</code>. Here, I used the later so we can confirm the files to be identical with md5sum:
|
|
<pre><samp>d56d71ecadf2137be09d8b1d35c6c042 bitcoin.pdf
|
|
d56d71ecadf2137be09d8b1d35c6c042 output.pdf</samp></pre>
|
|
|
|
<p>And they are! This concludes the basic introduction to steghide. Some advanced details follow below, but in most cases, reading the well-written man page suffices.</p>
|
|
|
|
|
|
</div>
|
|
</div><!-- /row -->
|
|
</div> <!-- /container -->
|
|
</div><!-- /grey -->
|
|
|
|
<!-- +++++ Second Post +++++ -->
|
|
<div id="anon3">
|
|
<div class="container">
|
|
<div class="row">
|
|
<div class="col-lg-8 col-lg-offset-2">
|
|
<h2><b>Advanced Use</b></h2>
|
|
<p></p>
|
|
<img src="" class="imgRz">
|
|
<pre><code class="nim">
|
|
|
|
</code></pre>
|
|
|
|
<p></p>
|
|
<img src="" class="imgRz">
|
|
<pre><code class="nim">
|
|
|
|
</code></pre>
|
|
|
|
<p></p>
|
|
<img src="" class="imgRz">
|
|
<pre><code class="nim">
|
|
|
|
</code></pre>
|
|
</div>
|
|
</div><!-- /row -->
|
|
</div> <!-- /container -->
|
|
</div><!-- /white -->
|
|
|
|
<div id="anon2">
|
|
<div class="container">
|
|
<div class="row">
|
|
<div class="col-lg-8 col-lg-offset-2">
|
|
<h2><b>Setup</b></h2> </br> </br>
|
|
<p></p>
|
|
<img src="" class="imgRz">
|
|
<pre><code class="nim">
|
|
|
|
</code></pre>
|
|
|
|
<p></p>
|
|
<img src="" class="imgRz">
|
|
<pre><code class="nim">
|
|
|
|
</code></pre>
|
|
|
|
<p></p>
|
|
<img src="" class="imgRz">
|
|
<pre><code class="nim">
|
|
|
|
</code></pre>
|
|
|
|
</div>
|
|
</div><!-- /row -->
|
|
</div> <!-- /container -->
|
|
</div><!-- /white -->
|
|
|
|
|
|
<!-- +++++ Second Post +++++ -->
|
|
<div id="anon1">
|
|
<div class="container">
|
|
<div class="row">
|
|
<div class="col-lg-8 col-lg-offset-2">
|
|
<h2><b>Setup</b></h2> </br> </br>
|
|
<p></p>
|
|
<pre><code class="nim">
|
|
|
|
</code></pre>
|
|
|
|
<p></p>
|
|
<pre><code class="nim">
|
|
|
|
</code></pre>
|
|
|
|
<p></p>
|
|
<pre><code class="nim">
|
|
|
|
</code></pre>
|
|
|
|
</div>
|
|
</div><!-- /row -->
|
|
</div> <!-- /container -->
|
|
</div><!-- /white -->
|
|
|
|
<!-- +++++ Footer Section +++++ -->
|
|
|
|
<div id="anonb">
|
|
<div class="container">
|
|
<div class="row">
|
|
<div class="col-lg-4">
|
|
<h4>Nihilism</h4>
|
|
<p>
|
|
Until there is Nothing left.
|
|
|
|
</p>
|
|
</div><!-- /col-lg-4 -->
|
|
|
|
<div class="col-lg-4">
|
|
<h4>My Links</h4>
|
|
<p>
|
|
|
|
<a target="_blank" rel="noopener noreferrer" href="http://blog.nowhere.moe/rss/feed.xml">RSS Feed</a><br/><a target="_blank" rel="noopener noreferrer" href="https://matrix.to/#/#nowheremoe:nowhere.moe">Matrix Chat</a><br/>
|
|
|
|
</p>
|
|
</div><!-- /col-lg-4 -->
|
|
|
|
<div class="col-lg-4">
|
|
<h4>About nihilist</h4>
|
|
<p style="word-wrap: break-word;"><u>Donate XMR:</u> 8AUYjhQeG3D5aodJDtqG499N5jXXM71gYKD8LgSsFB9BUV1o7muLv3DXHoydRTK4SZaaUBq4EAUqpZHLrX2VZLH71Jrd9k8</p></br><p><u>Contact:</u> nihilist@nowhere.moe (<a href="https://nowhere.moe/nihilist.pubkey">PGP</a>)</p>
|
|
</div><!-- /col-lg-4 -->
|
|
|
|
</div>
|
|
|
|
</div>
|
|
</div>
|
|
|
|
|
|
<!-- Bootstrap core JavaScript
|
|
================================================== -->
|
|
<!-- Placed at the end of the document so the pages load faster -->
|
|
|
|
</body>
|
|
</html>
|