Challenge: Beginner/Hidden out of sight
Category: Steganography
Something must be hidden in the darkness.
Downloads: image.gif
-
First we run strings on image.gif to check the metadata.
-
We are able to see that GIF89a and NETSCAPE2.0 is connected to ImageMagick. Therefore we install ImageMagick.
-
By converting the gif into all its .png components (total of 7) using the command
convert image.gif out.png
, we are able to inspect each of the components. -
Based on the description "Something must be hidden in the darkness" we first check the black picture.
-
Running the command
identify -verbose image.gif
we are able to see that the data stored in the 5th image (the black one from the gif) contains more data than the others. See picture below: -
The 8-bit colormap is a place where one can hide information. By using stegsolve we can scroll through the pictures, we find this:
-
And that there we have the flag
EPT{DID_YOU_SEE_ME??}