Steghide — Steganography Reference
What is Steghide?
Steghide embeds (hides) data inside image or audio files without visibly altering them, and extracts it back out. The hidden data can be passphrase-protected. Commonly encountered in CTF challenges where a flag or credential is hidden inside an image.
OSCP / CTF use: When you find an image file on a target or in a challenge — always try steghide. Even if there’s no passphrase, it may reveal hidden content.
Supported File Formats
| Type | Formats |
|---|---|
| Images | JPEG, BMP |
| Audio | WAV, AU |
PNG, GIF, and MP3 are not supported — use other tools for those (see bottom of note).
Syntax
steghide <command> [options]📌 1) Commands
| Command | Description |
|---|---|
embed | Embed a file inside a cover file |
extract | Extract hidden data from a stego file |
info | Display info about a file (detects embedded data) |
encinfo | List supported encryption algorithms |
version | Print version |
license | Print license |
help | Print help |
📌 2) All Flags
Embed flags
| Flag | Description |
|---|---|
-cf <file> | Cover file (the carrier — image or audio to hide data in) |
-sf <file> | Stego file (output — where the result is saved; defaults to cover file) |
-ef <file> | Embed file (the secret data to hide) |
-p <passphrase> | Passphrase to protect the embedded data |
-e <algo> | Encryption algorithm (default: rijndael-128 / AES-128) |
-z <level> | Compression level: 1 (fast) to 9 (best); 0 = none |
-K | Don’t embed a checksum |
-N | Don’t embed the original filename of the embed file |
-f | Force overwrite of output file without prompt |
-q | Quiet — suppress info messages |
-v | Verbose output |
Extract flags
| Flag | Description |
|---|---|
-sf <file> | Stego file to extract from |
-p <passphrase> | Passphrase (leave blank or omit to try no password) |
-xf <file> | Extract to this specific file path |
-f | Force overwrite if output file exists |
-q | Quiet |
-v | Verbose |
Info flags
| Flag | Description |
|---|---|
-sf <file> | File to inspect |
-p <passphrase> | Passphrase (reveals more detail if data is present) |
📌 3) Extracting Hidden Data
Try with no passphrase (blank)
steghide extract -sf image.jpg
# Press Enter when prompted for passphrase (try empty)Try with a known passphrase
steghide extract -sf image.jpg -p "password"
steghide extract -sf image.jpg -p "secret"
steghide extract -sf image.jpg -p ""Extract to a specific output file
steghide extract -sf image.jpg -p "password" -xf /tmp/extracted.txtQuiet extract (no prompts)
steghide extract -sf image.jpg -p "" -f -q📌 4) Inspecting a File (Info)
Check if a file has embedded data — and see metadata:
steghide info image.jpg
# With passphrase (shows payload size and name if correct)
steghide info image.jpg -p "password"Sample output (data present)
"image.jpg":
format: jpeg
capacity: 2.4 KB
Try to get information about embedded data ? (y/n) y
Enter passphrase:
embedded file "secret.txt":
size: 48.0 Byte
encrypted: rijndael-128, cbc
compressed: yes
Sample output (no embedded data / wrong passphrase)
steghide: could not extract any data with that passphrase!
📌 5) Embedding Hidden Data
Basic embed (will prompt for passphrase)
steghide embed -cf cover.jpg -ef secret.txtEmbed with passphrase
steghide embed -cf cover.jpg -ef secret.txt -p "mysecretpass"Save to a different output file (preserve original)
steghide embed -cf cover.jpg -ef secret.txt -p "pass" -sf stego_output.jpgEmbed without passphrase (no encryption)
steghide embed -cf cover.jpg -ef secret.txt -p ""Embed with no compression
steghide embed -cf cover.jpg -ef secret.txt -p "pass" -z 0Embed a file silently (force overwrite, quiet)
steghide embed -cf cover.jpg -ef payload.txt -p "pass" -f -q📌 6) Passphrase Brute-Force
Steghide has no built-in brute-force. Use stegseek (fastest — built for this) or slower alternatives.
Option 1 — stegseek (recommended)
Much faster than looping steghide extract — cracks steghide passphrases and auto-extracts the hidden file on success.
# Install
sudo apt install stegseek
# Or build from source if not in repos:
# git clone https://github.com/RickdeJager/stegseek.git && cd stegseek && make && sudo make install
# Crack with rockyou — extracts automatically on hit
stegseek image.jpg /usr/share/wordlists/rockyou.txt
# Explicit crack + output file
stegseek --crack image.jpg /usr/share/wordlists/rockyou.txt
# Specify output path
stegseek --crack image.jpg /usr/share/wordlists/rockyou.txt -xf extracted.txtIf it finds the password, you get the embedded file immediately (often image.jpg.out or -xf path).
stegcracker (Python — slower than stegseek)
# Install
pip3 install stegcracker
stegcracker image.jpg /usr/share/wordlists/rockyou.txt
stegcracker image.jpg /usr/share/wordlists/rockyou.txt --threads 8Bash loop (manual, slow — last resort)
while IFS= read -r pass; do
steghide extract -sf image.jpg -p "$pass" -f -q 2>/dev/null && \
echo "[+] Found passphrase: $pass" && break
done < /usr/share/wordlists/rockyou.txt📌 7) Encryption Algorithms
View all supported encryption types:
steghide encinfoCommon options (pass with -e):
| Algorithm | Flag |
|---|---|
| AES-128 (default) | rijndael-128 |
| AES-192 | rijndael-192 |
| AES-256 | rijndael-256 |
| Triple DES | tripledes |
| Blowfish | blowfish |
| No encryption | none |
# Embed with AES-256 instead of default AES-128
steghide embed -cf cover.jpg -ef secret.txt -p "pass" -e rijndael-256📌 8) CTF Workflow — Full Checklist
When you find a suspicious image or audio file in a CTF or on a target:
# 1. Check file type (don't trust the extension)
file image.jpg
file audio.wav
# 2. Check for metadata / EXIF data
exiftool image.jpg
# 3. Look at the raw strings
strings image.jpg | grep -i "flag\|pass\|ctf\|secret\|hidden"
# 4. Check for appended data / file signatures
xxd image.jpg | tail -20
binwalk image.jpg # Detect embedded files
# 5. Try steghide (blank password first)
steghide info image.jpg
steghide extract -sf image.jpg -p "" -f
# 6. Try common passwords manually
for pass in "" "password" "secret" "steghide" "hidden" "admin" "flag"; do
steghide extract -sf image.jpg -p "$pass" -f -q 2>/dev/null && \
echo "[+] Passphrase: $pass" && break
done
# 7. Brute force with stegseek
stegseek image.jpg /usr/share/wordlists/rockyou.txt
# 8. Try other steganography tools (see below)📌 9) Other Steganography Tools
Steghide only handles JPEG/BMP/WAV/AU. For other formats:
| Tool | Formats | Use Case |
|---|---|---|
stegseek | JPEG | Fast brute-force of steghide-protected files |
stegcracker | JPEG/BMP | Python steghide brute-forcer |
zsteg | PNG, BMP | LSB steganography detection |
stegoVeritas | Many | Automated multi-method steg detection |
stegsolve | Images | Visual analysis — channel planes, LSB |
outguess | JPEG | Alternative JPEG steg tool |
LSBSteg | PNG | LSB encoding/decoding |
exiftool | Any | Read/write EXIF metadata |
binwalk | Any | Detect embedded files inside files |
foremost | Any | Carve embedded files out by signature |
strings | Any | Check for plain-text hidden data |
xxd / hexdump | Any | Raw hex inspection |
pngcheck | PNG | Check PNG integrity and metadata |
sonic visualiser | Audio | Visual analysis of audio spectrograms |
# zsteg — PNG LSB analysis
zsteg image.png
zsteg -a image.png # Try all methods
zsteg -b 1 -o lsb image.png # Specific bit plane
# binwalk — find embedded files
binwalk image.jpg
binwalk -e image.jpg # Extract automatically
# exiftool — metadata
exiftool image.jpg📌 Quick OSCP / CTF Cheat Sheet (Copy/Paste)
# Check if data is hidden
steghide info image.jpg
# Extract — blank passphrase
steghide extract -sf image.jpg -p "" -f
# Extract — known passphrase
steghide extract -sf image.jpg -p "PASSWORD"
# Brute force (fastest method)
stegseek image.jpg /usr/share/wordlists/rockyou.txt
# Embed data
steghide embed -cf cover.jpg -ef secret.txt -p "passphrase" -sf output.jpg
# Check file type + metadata
file image.jpg && exiftool image.jpg
# Look for embedded files
binwalk -e image.jpg
# Check raw strings
strings image.jpg | grep -i "flag\|pass\|secret"