Skip to content
Detect hidden files and text in images
Branch: master
Clone or download
Latest commit 1f72320 May 30, 2018
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
examples refactoring. string exctraction now optional. new -q and -s flags Apr 16, 2018
.gitignore refactoring. string exctraction now optional. new -q and -s flags Apr 16, 2018
LICENSE Update LICENSE Apr 6, 2018
README.MD Update README.MD May 30, 2018
poc.gif refactoring. string exctraction now optional. new -q and -s flags Apr 16, 2018
stegextract

README.MD

Stegextract

Bash script to extract hidden files and strings from images.

Description

Stegextract extracts any trailing data after the image's closing bytes, and any hidden files (or other images) embedded within the image.
Short byte combinations such as JPEG's FFD8 FFE0 might sometimes create false positives.
Manually reviewing the hexdump is sometimes inevitable in cases of highly complex embedded files.
Stegextract is not the solution for any color/pixel/filter/LSB related Steganography, nor does it try to be. It relies on magic numbers, hexdumps and binary data alone.
Currently supports PNG, JPG, and GIF.

Update: --analyze flag was deprecated and is now being performed automatically with every scan.

Installation

sudo curl https://raw.githubusercontent.com/evyatarmeged/stegextract/master/stegextract > /usr/local/bin/stegextract
sudo chmod +x /usr/local/bin/stegextract

Usage

Usage: stegextract <file> [options]

-h, --help                Print this and exit
-o, --outfile             Specify an outfile
-s, --strings             Extract strings from file
-q, --quiet               Do not output to stdout
--force-format            Force this image format instead of detecting

POC:

poc

Image examples from the above GIF can be found in the examples folder.

You can’t perform that action at this time.