ineedcodes 1.6.1 → 1.7.1

package/skills/steganography-techniques/SKILL.md

@@ -0,0 +1,348 @@
+---
+name: steganography-techniques
+description: >-
+  Steganography detection and extraction playbook. Use when analyzing images (LSB, PNG chunks, JPEG DCT, EXIF), audio (spectrogram, DTMF), files (polyglots, appended data, ADS), and text (whitespace, zero-width, homoglyphs) for hidden data.gated: true
+---
+
+# SKILL: Steganography Techniques — Expert Analysis Playbook
+
+> **AI LOAD INSTRUCTION**: Expert steganography detection and extraction techniques. Covers image steganography (LSB, PNG chunk hiding, JPEG DCT, EXIF metadata, dimension tricks, palette manipulation), audio steganography (spectrogram, LSB, DTMF, morse), file steganography (polyglots, binwalk, NTFS ADS, steghide), and text steganography (whitespace, zero-width Unicode, homoglyphs). Base models miss the systematic file-type-based analysis approach and tool-specific extraction workflows.
+
+## 0. RELATED ROUTING
+
+Before going deep, consider loading:
+
+- [traffic-analysis-pcap](../traffic-analysis-pcap/SKILL.md) for extracting files from network captures before stego analysis
+- [memory-forensics-volatility](../memory-forensics-volatility/SKILL.md) for extracting files from memory dumps
+- [classical-cipher-analysis](../classical-cipher-analysis/SKILL.md) if extracted hidden data is further encrypted/encoded
+
+### Tool Reference
+
+Also load [STEGO_TOOLS_GUIDE.md](./STEGO_TOOLS_GUIDE.md) when you need:
+- Tool installation instructions and dependencies
+- Detailed command reference for each stego tool
+- Workflow patterns for specific file types
+
+---
+
+## 1. IMAGE STEGANOGRAPHY
+
+### LSB (Least Significant Bit)
+
+LSB embeds data in the least significant bits of pixel color channels.
+
+```bash
+# zsteg — LSB analysis for PNG/BMP
+zsteg image.png                       # auto-detect all LSB patterns
+zsteg image.png -a                    # try all known methods
+zsteg image.png -b 1                  # extract bit plane 1
+zsteg image.png -E "b1,rgb,lsb,xy"   # specific extraction pattern
+
+# StegSolve (Java GUI)
+java -jar StegSolve.jar
+# Navigate color planes: Red 0, Green 0, Blue 0 → look for hidden image/text
+# Data Extractor: specify bit planes + byte order
+
+# stegoveritas — comprehensive automated analysis
+stegoveritas image.png
+# Runs: exiftool, binwalk, zsteg, foremost, color plane extraction
+```
+
+### PNG Specific
+
+```bash
+# pngcheck — validate structure, find hidden chunks
+pngcheck -v image.png
+
+# Hidden chunks: tEXt, zTXt (compressed text), iTXt (international text)
+# Custom/private chunks may contain hidden data
+
+# CRC vs dimensions trick
+# If CRC doesn't match declared dimensions → image was cropped
+# Fix: brute-force correct width/height → reveals hidden rows/columns
+python3 -c "
+import struct, zlib
+with open('image.png','rb') as f:
+    data = f.read()
+# Check IHDR CRC at offset 29
+ihdr = data[12:29]
+for h in range(1,2000):
+    for w in range(1,2000):
+        new_ihdr = struct.pack('>II',w,h) + ihdr[8:]
+        if zlib.crc32(b'IHDR'+new_ihdr) & 0xffffffff == struct.unpack('>I',data[29:33])[0]:
+            print(f'Width: {w}, Height: {h}')
+"
+
+# APNG (animated PNG) — hidden frames
+# Use apngdis to extract all frames: apngdis image.png
+```
+
+### JPEG Specific
+
+```bash
+# steghide — embed/extract from JPEG (DCT coefficient modification)
+steghide extract -sf image.jpg                 # extract (no passphrase)
+steghide extract -sf image.jpg -p PASSWORD     # extract with passphrase
+steghide info image.jpg                        # check if data is embedded
+
+# stegcracker — brute force steghide passphrase
+stegcracker image.jpg wordlist.txt
+
+# jsteg — JPEG LSB steganography
+jsteg reveal image.jpg output.txt
+
+# JPEG structure analysis
+exiftool -v3 image.jpg       # verbose metadata + structure
+jpegdump image.jpg           # raw JPEG marker analysis
+```
+
+### EXIF Metadata
+
+```bash
+# exiftool — comprehensive metadata extraction
+exiftool image.jpg
+exiftool -b -ThumbnailImage image.jpg > thumb.jpg   # extract thumbnail
+exiftool -all= image.jpg                             # strip all metadata
+
+# Hidden data in EXIF fields (comment, artist, copyright, etc.)
+exiftool -Comment image.jpg
+exiftool -UserComment image.jpg
+strings image.jpg | grep -i "flag\|key\|secret"
+```
+
+### Palette-Based (GIF)
+
+```bash
+# GIF color table manipulation — data in color palette order
+gifsicle -I image.gif                    # info
+gifsicle --color-info image.gif          # palette details
+# Check for animation frames: convert -coalesce image.gif frame_%d.png
+```
+
+---
+
+## 2. AUDIO STEGANOGRAPHY
+
+### Spectrogram Analysis
+
+```bash
+# Sonic Visualiser — best for spectrogram viewing
+# Layer → Add Spectrogram → look for visual patterns (text/images)
+
+# Audacity
+# Analyze → Plot Spectrum
+# Select audio → change view to Spectrogram
+
+# sox for command-line spectrogram generation
+sox audio.wav -n spectrogram -o spectro.png
+```
+
+### Audio LSB
+
+```bash
+# DeepSound — hide/extract files in audio (Windows)
+# GUI tool: open audio file → extract hidden files
+
+# WavSteg — LSB in WAV files
+python3 WavSteg.py -r -i audio.wav -o output.txt -n 1   # extract 1 LSB
+python3 WavSteg.py -r -i audio.wav -o output.txt -n 2   # extract 2 LSBs
+```
+
+### DTMF / Morse Code
+
+```bash
+# DTMF decoder (phone tones)
+multimon-ng -t wav -a DTMF audio.wav
+
+# Morse code
+# Audacity → visual inspection of on/off pattern
+# Online decoder or manual: .- = A, -... = B, etc.
+
+# SSTV (Slow-Scan Television) — image in audio
+qsstv                    # GUI decoder
+# Or: RX-SSTV (Windows)
+```
+
+### WAV Header Manipulation
+
+```bash
+# Check for data appended after WAV audio data
+# WAV data chunk size vs actual file size
+python3 -c "
+import wave
+w = wave.open('audio.wav','rb')
+print(f'Frames: {w.getnframes()}, Channels: {w.getnchannels()}, Width: {w.getsampwidth()}')
+expected = w.getnframes() * w.getnchannels() * w.getsampwidth() + 44  # 44 = WAV header
+import os
+actual = os.path.getsize('audio.wav')
+if actual > expected:
+    print(f'Extra data: {actual - expected} bytes appended')
+"
+```
+
+---
+
+## 3. FILE STEGANOGRAPHY
+
+### Polyglot Files
+
+A single file that is valid in two or more formats simultaneously.
+
+```bash
+# Detection: check file with multiple tools
+file suspicious_file
+xxd suspicious_file | head          # check magic bytes
+binwalk suspicious_file             # find embedded files
+
+# Common polyglots: PDF+ZIP, JPEG+ZIP, JPEG+RAR, PNG+ZIP
+# Try unzip on image files:
+unzip image.jpg -d extracted/
+7z x image.jpg -oextracted/
+```
+
+### Appended / Embedded Data
+
+```bash
+# binwalk — scan for embedded files and data
+binwalk image.png                   # scan
+binwalk -e image.png                # extract embedded files
+binwalk --dd='.*' image.png         # extract everything
+
+# foremost — file carving
+foremost -i suspicious_file -o output_dir/
+
+# dd — manual extraction
+# If binwalk shows embedded ZIP at offset 0x1234:
+dd if=suspicious_file bs=1 skip=$((0x1234)) of=extracted.zip
+```
+
+### NTFS Alternate Data Streams (ADS)
+
+```cmd
+:: List ADS (Windows)
+dir /r file.txt
+Get-Item file.txt -Stream *
+
+:: Read hidden stream
+more < file.txt:hidden_stream
+Get-Content file.txt -Stream hidden_stream
+
+:: Create ADS (for testing)
+echo "hidden data" > file.txt:secret
+```
+
+### Steghide Brute Force
+
+```bash
+# stegcracker — wordlist attack on steghide passphrase
+stegcracker image.jpg /usr/share/wordlists/rockyou.txt
+
+# stegseek — faster alternative
+stegseek image.jpg /usr/share/wordlists/rockyou.txt
+# stegseek is ~10000x faster than stegcracker
+```
+
+---
+
+## 4. TEXT STEGANOGRAPHY
+
+### Whitespace Encoding
+
+```bash
+# Tabs and spaces encode binary (tab=1, space=0 or vice versa)
+# stegsnow — whitespace steganography
+stegsnow -C message.txt                # extract hidden message
+stegsnow -C -p PASSWORD message.txt    # extract with password
+
+# Manual detection:
+cat -A file.txt | head     # show tabs (^I) and line endings ($)
+xxd file.txt | grep "09 20\|20 09"    # look for tab/space patterns
+```
+
+### Zero-Width Characters
+
+```bash
+# Unicode invisible characters used for encoding:
+# U+200B (Zero-Width Space), U+200C (ZWNJ), U+200D (ZWJ), U+FEFF (BOM)
+
+# Detection:
+python3 -c "
+text = open('message.txt','r').read()
+hidden = [c for c in text if ord(c) in [0x200b, 0x200c, 0x200d, 0xfeff]]
+print(f'Found {len(hidden)} zero-width characters')
+binary = ''.join('0' if ord(c)==0x200b else '1' for c in hidden)
+# Convert binary to ASCII
+"
+
+# Online tools: holloway.nz/steg, Unicode Steganography decoders
+```
+
+### Homoglyph Substitution
+
+```bash
+# Visually identical characters from different Unicode blocks
+# e.g., Latin 'a' (U+0061) vs Cyrillic 'а' (U+0430)
+
+# Detection:
+python3 -c "
+text = open('message.txt','r').read()
+for i, c in enumerate(text):
+    if ord(c) > 127:
+        print(f'Position {i}: char={c} ord={ord(c)} name={__import__(\"unicodedata\").name(c,\"?\")}')
+"
+```
+
+---
+
+## 5. DECISION TREE
+
+```
+Suspect hidden data — what file type?
+│
+├── Image (PNG/BMP)?
+│   ├── Check metadata: exiftool (§1 EXIF)
+│   ├── Check structure: pngcheck, binwalk (§1 PNG)
+│   ├── LSB analysis: zsteg, StegSolve (§1 LSB)
+│   ├── Check dimensions vs CRC: height/width brute force (§1 PNG)
+│   ├── Check for appended data: binwalk -e (§3)
+│   └── Try as polyglot: unzip/7z (§3)
+│
+├── Image (JPEG)?
+│   ├── Check metadata: exiftool (§1 EXIF)
+│   ├── Try steghide: steghide extract (§1 JPEG)
+│   │   └── Password protected? → stegseek brute force (§3)
+│   ├── Try jsteg: jsteg reveal (§1 JPEG)
+│   ├── Check for appended data: binwalk -e (§3)
+│   └── Check thumbnail: exiftool -b -ThumbnailImage (§1 EXIF)
+│
+├── Image (GIF)?
+│   ├── Check frames: extract all animation frames (§1 Palette)
+│   ├── Check palette: gifsicle --color-info (§1 Palette)
+│   └── Check for appended data: binwalk -e (§3)
+│
+├── Audio (WAV/MP3/FLAC)?
+│   ├── Spectrogram: Sonic Visualiser / Audacity (§2)
+│   ├── LSB: WavSteg (§2)
+│   ├── DTMF tones: multimon-ng (§2)
+│   ├── Morse code: manual or decoder (§2)
+│   ├── SSTV: qsstv (§2)
+│   └── Check file size vs expected: header analysis (§2)
+│
+├── Text file?
+│   ├── Check whitespace: cat -A, stegsnow (§4)
+│   ├── Check zero-width chars: Unicode analysis (§4)
+│   ├── Check homoglyphs: non-ASCII detection (§4)
+│   └── Check encoding: multiple base decodings
+│
+├── Any file type?
+│   ├── strings: strings -n 8 file | grep -i "flag\|key\|pass"
+│   ├── binwalk: binwalk -e file (embedded files) (§3)
+│   ├── file: file suspicious_file (true type)
+│   ├── xxd: check magic bytes, compare headers
+│   └── NTFS? → check ADS: dir /r (§3)
+│
+└── Password/passphrase needed?
+    ├── steghide → stegseek / stegcracker (§3)
+    ├── Check challenge description for hints
+    └── Try common passwords: password, file name, challenge name
+```

package/skills/steganography-techniques/STEGO_TOOLS_GUIDE.md

@@ -0,0 +1,335 @@
+---
+name: stego-tools-guide
+description: >-
+  Steganography tool installation guide, usage patterns, and command reference for image, audio, file, and text stego analysis.
+---
+
+# STEGANOGRAPHY TOOLS GUIDE
+
+> Supplementary reference for [steganography-techniques](./SKILL.md). Installation and detailed usage for each tool.
+
+---
+
+## 1. MULTI-PURPOSE TOOLS
+
+### stegoveritas
+
+Automated steganography analysis — runs multiple tools in one pass.
+
+```bash
+# Install
+pip3 install stegoveritas
+stegoveritas_install_deps
+
+# Usage — full automated analysis
+stegoveritas image.png
+# Runs: exiftool, binwalk, zsteg, foremost, trailing data check
+# Extracts: color planes, LSB data, embedded files
+# Output: results/ directory with all findings
+
+stegoveritas image.png -meta         # metadata only
+stegoveritas image.png -imageTransform   # color plane extraction only
+stegoveritas image.png -extractLSB   # LSB extraction only
+```
+
+### binwalk
+
+Firmware/file analysis and extraction.
+
+```bash
+# Install
+sudo apt install binwalk
+# or: pip3 install binwalk
+
+# Scan for embedded files
+binwalk file.png
+
+# Extract embedded files
+binwalk -e file.png                  # extract known types
+binwalk --dd='.*' file.png           # extract everything
+binwalk -Me file.png                 # recursive extraction
+
+# Entropy analysis (detect encrypted/compressed regions)
+binwalk -E file.png
+```
+
+### foremost
+
+File carving tool — recovers files from raw data.
+
+```bash
+# Install
+sudo apt install foremost
+
+# Carve files
+foremost -i suspicious_file -o output_dir/
+foremost -t all -i disk_image.raw -o carved/
+
+# Specific file types
+foremost -t pdf,jpg,zip -i data.bin -o output/
+```
+
+---
+
+## 2. IMAGE TOOLS
+
+### zsteg
+
+PNG/BMP LSB steganography detector.
+
+```bash
+# Install
+gem install zsteg
+
+# Auto-detect all LSB patterns
+zsteg image.png
+
+# Verbose scan with all methods
+zsteg image.png -a
+
+# Specific extraction
+zsteg image.png -b 1                        # bit plane 1
+zsteg image.png -E "b1,rgb,lsb,xy"          # specific pattern
+zsteg image.png -E "b1,r,lsb,xy"            # red channel only
+zsteg image.png -E "b2,bgr,msb,yx"          # MSB, BGR order
+
+# Extract to file
+zsteg image.png -E "b1,rgb,lsb,xy" > extracted.bin
+```
+
+### StegSolve
+
+Java GUI for visual bit plane analysis.
+
+```bash
+# Install
+wget http://www.caesum.com/handbook/Stegsolve.jar
+
+# Run
+java -jar Stegsolve.jar
+
+# Key features:
+# Analyse → File Format: check headers and structure
+# Analyse → Data Extract: specify bit planes to extract
+# Arrow keys: cycle through color planes (R0-R7, G0-G7, B0-B7, Alpha)
+# XOR/AND/OR with second image for comparison
+```
+
+### steghide
+
+JPEG/WAV/BMP/AU steganography with encryption.
+
+```bash
+# Install
+sudo apt install steghide
+
+# Check if data is embedded
+steghide info image.jpg
+
+# Extract (no password)
+steghide extract -sf image.jpg
+
+# Extract with password
+steghide extract -sf image.jpg -p "password"
+
+# Embed data (for testing)
+steghide embed -cf cover.jpg -ef secret.txt -p "password"
+```
+
+### stegseek
+
+Fast steghide passphrase cracker (~10000x faster than stegcracker).
+
+```bash
+# Install
+wget https://github.com/RickdeJager/stegseek/releases/latest/download/stegseek_amd64.deb
+sudo dpkg -i stegseek_amd64.deb
+
+# Crack passphrase
+stegseek image.jpg /usr/share/wordlists/rockyou.txt
+
+# Seed crack (try without wordlist)
+stegseek --seed image.jpg
+```
+
+### jsteg
+
+JPEG LSB steganography.
+
+```bash
+# Install
+go install github.com/lukechampine/jsteg@latest
+
+# Extract
+jsteg reveal image.jpg
+
+# Embed (for testing)
+jsteg hide cover.jpg secret.txt output.jpg
+```
+
+### pngcheck
+
+PNG structure validator.
+
+```bash
+# Install
+sudo apt install pngcheck
+
+# Validate and show chunk info
+pngcheck -v image.png
+
+# Show text chunks
+pngcheck -t image.png
+
+# Full verbose with data
+pngcheck -vtp7f image.png
+```
+
+### exiftool
+
+Metadata extraction and manipulation.
+
+```bash
+# Install
+sudo apt install libimage-exiftool-perl
+
+# All metadata
+exiftool image.jpg
+
+# Specific fields
+exiftool -Comment image.jpg
+exiftool -UserComment image.jpg
+exiftool -GPSLatitude -GPSLongitude image.jpg
+
+# Extract thumbnail
+exiftool -b -ThumbnailImage image.jpg > thumbnail.jpg
+
+# Verbose structure
+exiftool -v3 image.jpg
+
+# Strip all metadata
+exiftool -all= image.jpg
+```
+
+---
+
+## 3. AUDIO TOOLS
+
+### Sonic Visualiser
+
+Best spectrogram viewer for stego analysis.
+
+```bash
+# Install
+sudo apt install sonic-visualiser
+
+# Usage:
+# 1. Open audio file
+# 2. Layer → Add Spectrogram
+# 3. Adjust: Window=4096, Overlap=87.5%, Scale=dBV
+# 4. Look for patterns (text, QR codes, images in frequency domain)
+```
+
+### multimon-ng
+
+Decoder for DTMF, POCSAG, and other digital modes.
+
+```bash
+# Install
+sudo apt install multimon-ng
+
+# DTMF decode
+multimon-ng -t wav -a DTMF audio.wav
+
+# Multiple decoders
+multimon-ng -t wav -a DTMF -a MORSE_CW audio.wav
+
+# From raw audio input
+sox audio.wav -t raw -r 22050 -e signed -b 16 -c 1 - | multimon-ng -t raw -
+```
+
+### DeepSound
+
+Audio steganography tool (Windows).
+
+```bash
+# GUI application — Windows only
+# 1. Open carrier audio file
+# 2. Click "Extract Secret Files"
+# 3. Enter password if prompted
+
+# Alternative for Linux: use WavSteg for WAV LSB analysis
+```
+
+---
+
+## 4. TEXT TOOLS
+
+### stegsnow
+
+Whitespace steganography in text files.
+
+```bash
+# Install
+sudo apt install stegsnow
+
+# Extract hidden message
+stegsnow -C message.txt
+
+# Extract with password
+stegsnow -C -p "password" message.txt
+
+# Embed (for testing)
+stegsnow -C -m "hidden message" -p "password" cover.txt stego.txt
+```
+
+---
+
+## 5. RECOMMENDED ANALYSIS WORKFLOW
+
+### Quick Triage (Any File)
+
+```bash
+file suspicious_file
+exiftool suspicious_file
+strings -n 8 suspicious_file | head -50
+binwalk suspicious_file
+xxd suspicious_file | head -20
+```
+
+### Image Deep Analysis
+
+```bash
+exiftool -v3 image.*
+pngcheck -v image.png         # if PNG
+steghide info image.jpg       # if JPEG
+zsteg -a image.png            # if PNG/BMP
+stegoveritas image.*          # comprehensive automated scan
+binwalk -e image.*            # embedded file extraction
+```
+
+### Audio Deep Analysis
+
+```bash
+exiftool audio.*
+file audio.*
+sox audio.wav -n spectrogram -o spectro.png
+multimon-ng -t wav -a DTMF audio.wav
+# Open in Sonic Visualiser for spectrogram inspection
+# Check file size vs expected duration
+```
+
+### Password Recovery for Steghide
+
+```bash
+# Fast: stegseek
+stegseek image.jpg /usr/share/wordlists/rockyou.txt
+
+# Slow fallback: stegcracker
+stegcracker image.jpg /usr/share/wordlists/rockyou.txt
+
+# Manual: try common passwords
+for p in password flag secret admin test ""; do
+    steghide extract -sf image.jpg -p "$p" 2>/dev/null && echo "Password: '$p'" && break
+done
+```