Stego 1

Find what's hiding in plain sight

Re: Stego One

Post by JC5 on Thu May 29, 2008 2:08 pm
([msg=3520]see Re: Stego One[/msg])

Im in the same position as JC5, I am new to this whole stego thing. Can someone just help me and show me how these work. Thanks


dont expect to get spoonfed. thats one of their big ticks. im willing to google but i have no idea what topic to google. ne ideas? i was looking above where someone said hex to text conversions but when i googled that it didnt help me much
JC5
New User
New User
 
Posts: 12
Joined: Wed May 14, 2008 5:29 pm
Blog: View Blog (0)


Re: Stego One

Post by int3grate on Thu May 29, 2008 3:33 pm
([msg=3528]see Re: Stego One[/msg])

I've been working on it for a few weeks. I'm not exactly sure what to do with it. I see two groups of two NULL bytes in the data section of the BMP file, but I'm not sure what I need to do with them. I've already tried messing with the color table to see If I could get something to show up, but no luck so far. Am I even heading in the right direction? Thanks,

Int3grate
int3grate
New User
New User
 
Posts: 38
Joined: Tue May 27, 2008 7:54 pm
Blog: View Blog (0)


Re: Stego One

Post by G__ on Fri May 30, 2008 11:39 am
([msg=3738]see Re: Stego One[/msg])

This is really annoying!

I understand how steganography works but I cannot realize how to reverse it.

I cannot find the source of the stegged 1.bmp . So I cannot compare two files
in order to find the different bytes.
I have also downloaded a lot of steganography software but no revealing of the
text is possible.

I would like someone to show me exactly what to do, in order to get the touch of it,
but I guess I will lose the joy of solving for stego 1.

Thanks in advance for any recommendation. A tutorial would also be fine but I cannot
find one in Google. Please give me something.
G__
New User
New User
 
Posts: 3
Joined: Wed May 28, 2008 4:41 am
Blog: View Blog (0)


Re: Stego One

Post by 193zaitsev on Fri May 30, 2008 12:33 pm
([msg=3739]see Re: Stego One[/msg])

If your looking to view the source of some file, try a hex editor or similar.
193zaitsev
New User
New User
 
Posts: 36
Joined: Wed May 21, 2008 10:28 pm
Location: USA
Blog: View Blog (0)


Re: Stego One

Post by G__ on Fri May 30, 2008 12:51 pm
([msg=3740]see Re: Stego One[/msg])

I use ultraedit to view the binary of the bmp

What I meant is that 1.bmp is steganographed.
If I had the prototype file I could compare the two files steganographed one and not steganographed one
and I would know where the difference is.
Last edited by G__ on Tue Jul 01, 2008 7:16 am, edited 1 time in total.
G__
New User
New User
 
Posts: 3
Joined: Wed May 28, 2008 4:41 am
Blog: View Blog (0)


Re: Stego One

Post by sandwich on Fri May 30, 2008 2:14 pm
([msg=3747]see Re: Stego One[/msg])

ooh this is annoying. The original image is here:
http://www.rootthisbox.net/pages/index/training.jpg
But it's not in greyscale!

I've now opened the thing in PSPad and found the offsets of the null bytes from the front of the file and from each other - am I close or am I just missing the big picture (so to speak)?
sandwich
New User
New User
 
Posts: 7
Joined: Mon May 12, 2008 5:30 pm
Blog: View Blog (0)


Re: Stego One

Post by 193zaitsev on Fri May 30, 2008 3:01 pm
([msg=3751]see Re: Stego One[/msg])

I didn't realize there was an original. It's not really needed when you figure out what the hint is implying.
193zaitsev
New User
New User
 
Posts: 36
Joined: Wed May 21, 2008 10:28 pm
Location: USA
Blog: View Blog (0)


Re: Stego One

Post by sandwich on Fri May 30, 2008 3:06 pm
([msg=3753]see Re: Stego One[/msg])

Yeh I understand that now. Although am I thinking the right way? Have I got the information I need or should I gather some more? I've tried converting the HEX in between the nulls, the offsets etc. to all sorts of things (DEC, ASCII etc), but to no avail.
sandwich
New User
New User
 
Posts: 7
Joined: Mon May 12, 2008 5:30 pm
Blog: View Blog (0)


Re: Stego One

Post by G__ on Fri May 30, 2008 3:49 pm
([msg=3759]see Re: Stego One[/msg])

What does the tip imply?
G__
New User
New User
 
Posts: 3
Joined: Wed May 28, 2008 4:41 am
Blog: View Blog (0)


Re: Stego One

Post by BhaaL on Sat May 31, 2008 5:19 am
([msg=3805]see Re: Stego One[/msg])

The tip refers to two null bytes. Always did and always will.
I wonder if they mark some spot...
BhaaL
Poster
Poster
 
Posts: 270
Joined: Sun Apr 13, 2008 11:16 am
Blog: View Blog (0)


PreviousNext

Return to Steganography

Who is online

Users browsing this forum: No registered users and 0 guests