| Forensics - Steganalysis | #Protocol

Checklist https://georgeom.net/StegOnline/checklist


===[Main]===
strings -n 7 -t x [File]
Outguess
stegsolve + steghide

Image:
	EXIF
	pngcheck -vtp7f [File]
Binary:
	Binwalk -Me [File]

[#Tool]


===[Automation]===
stego-toolkit/script



| Forensics - Steganalysis | #Tools

===[Analysis]===
Outguess
Openstego
Binwalk https://tools.kali.org/forensics/binwalk
stego-toolkit https://github.com/DominicBreuker/stego-toolkit
steghide
stegsolve https://en.kali.tools/all/?tool=1762
--------------------
JPEGsnoop
jphide
pngcheck

===[EXIF]===
exiftool

===[Online]===
https://georgeom.net/StegOnline/upload



| Forensics - Steganalysis | Image

===[MIME]===
JPG:
	Start: FF D8
	End: FF D9

PNG:
	Start: 89 50 4E 47
	End: AE 42 60 82

BMP:
	Start: 42 4D 36

GIF:
	Start: 47 49 46 38


===[Corrupt]===
pngcheck -vtp7f [png]
 

================================================================================
MIME: https://resources.infosecinstitute.com/steganalysis-x-ray-vision-hidden-data/
Corrupted PNG: https://github.com/ctfs/write-ups-2015/tree/master/plaidctf-2015/forensics/png-uncorrupt
	https://github.com/ctfs/write-ups-2015/tree/master/seccon-quals-ctf-2015/stegano/steganography-2
Zip: https://dominicbreuker.com/post/stego_book_of_secrets/