Data hidden in images (strings/steganography)

Steganography hides information inside another file, and in CTFs an image often conceals a password, a key or a hint. Before reaching for specialised tools, the cheapest reflex is worth it: strings, which extracts the printable text sequences from a binary. Many challenges simply append text to the end of the image file, which stays valid because viewers stop reading at the end-of-image marker:

strings PassPass.jpg | tail
# ...
# 4c4f34645f4d795f426f7373

The recovered text is almost never the final password: it usually comes encoded (base64, hex, decimal, ROT13) so it does not stand out at a glance. You have to identify the scheme and decode in a chain; for example a decimal → hex → text or a plain xxd -r -p:

echo -n "4c4f34645f4d795f426f7373" | xxd -r -p
# LO4d_My_Boss

If strings is not enough, the next step is dedicated tools: exiftool (EXIF metadata), binwalk (embedded files), steghide extract (password-protected hidden data) or zsteg (LSB in PNG). The logical order runs from least to most effort: strings → exiftool → binwalk → steghide.

Requirements. Access to the image file and, often, a contextual hint (a message mentioning the image, a name like PassPass.jpg) confirming that something is hidden there.

Defence. In a real setting, steganography is more an exfiltration channel than a server flaw: watch for anomalous attachments and do not rely on "security through obscurity" to store secrets. It usually feeds a credential reuse or later access.