Steganography challenges hide data inside a file that still looks and opens completely normally — a photo that opens fine in any viewer, with a flag buried inside pixel data nobody would notice just by looking.
1. Try steghide first, with an empty password
steghide hides data inside JPEG, BMP, WAV, and AU files using a passphrase. Many beginner challenges use no passphrase at all, so always try an empty one before assuming you need to find one:
steghide extract -sf image.jpgIf that fails with a password error, the challenge likely wants you to find the passphrase elsewhere (often in the challenge description itself, or hidden in the file's own metadata) before this step works.
2. Move to zsteg for PNG and BMP
steghide doesn't work on PNG files by design — zsteg fills that gap, specifically targeting the least-significant-bit (LSB) techniques common in PNG/BMP stego, where data is hidden in the low-order bits of pixel color values (changes too subtle for the human eye to notice):
zsteg image.pngzsteg automatically tries a range of bit-plane and channel combinations and flags anything that looks like readable data or a known file signature.
3. Check for an appended file before either tool
Before reaching for stego-specific tools, run binwalk or file on the image — some challenges simply concatenate a second file (a ZIP, another image) onto the end of a valid one, which isn't LSB steganography at all and extracts with ordinary archive tools once spotted.
binwalk image.png4. When both tools come up empty
If neither finds anything, reconsider the file type — some stego challenges use audio spectrograms (open the WAV in Audacity or Sonic Visualiser and view its spectrogram; text is sometimes drawn directly into the frequency data) rather than LSB image techniques at all.
Wrapping up
Stego challenges reward checking the boring things first — an appended file, an empty passphrase — before reaching for anything more exotic. Our Hideme writeup and binwalk tutorial both cover the appended-file case in more depth.