Challenge description

The challenge provides a flag.png image and simply asks:

The image opens normally in a viewer — it displays a regular image. Nothing suspicious at first glance. That's where the magic of forensics tools comes in.

Key concepts — Steganography

Steganography is the practice of hiding data inside other files. Unlike cryptography, which encrypts data, steganography conceals it.

A common CTF technique: hiding a ZIP file at the end of a PNG image. The image viewer ignores everything that comes after the end of the image (IEND), but a ZIP file read from the end of the file is perfectly valid.

Step 1 — Identify the file

We always start with the file command to confirm the nature of the file:

$ file flag.png
flag.png: PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced

It is indeed a PNG. But let's dig deeper with binwalk.

Step 2 — Scan with binwalk

binwalk is a tool that scans a file looking for known file signatures (ZIP, ELF, JPEG, etc.) hidden inside.

$ binwalk flag.png

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             PNG image, 512 x 512, 8-bit/color RGBA, non-interlaced
39739         0x9B3B          Zip archive data, at least v1.0 to extract
39906         0x9BE2          Zip archive data, at least v2.0 to extract, name: secret/flag.png
40202         0x9D0A          End of Zip archive, footer signature

Bingo. binwalk detects a ZIP file embedded at offset 39739, which itself contains a secret/flag.png file.

Step 3 — Extract the content

We automatically extract all detected files with the -e flag:

$ binwalk -e flag.png

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             PNG image...
39739         0x9B3B          Zip archive data...

$ ls
flag.png  _flag.png.extracted/

$ ls _flag.png.extracted/
9B3B.zip  secret/

$ ls _flag.png.extracted/secret/
flag.png

Step 4 — Read the flag

We open the extracted image secret/flag.png in an image viewer — the flag is displayed there as text.

$ eog _flag.png.extracted/secret/flag.png
# or: xdg-open, feh, display...

The flag is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

This challenge teaches two fundamental reflexes in CTF forensics:

• Never trust a file's extension — use file to verify
• Systematically scan suspicious files with binwalk before any other analysis
• Images are one of the most common steganography vectors in CTFs

In a real security context, this technique is used in malware to exfiltrate data hidden inside seemingly innocent images.

Installing binwalk

# Debian / Ubuntu / Kali
$ sudo apt install binwalk

# macOS
$ brew install binwalk

# pip
$ pip install binwalk

Resources

• binwalk — official GitHub
• Steganography — Wikipedia
• binwalk on Kali Linux

Related reading

Web 2025-05-15 · PicoCTF 2019

PicoCTF Cookies Writeup — Full Walkthrough & Flag

Manipulating HTTP cookies to enumerate hidden values and capture the flag. Technique: IDOR via a sequential cookie.