Forensics

What Lies Within

picoCTF 2019

13 February 2020

Points: 150

Problem :lock:

Theres something in the building. Can you retrieve the flag?

Hint :bulb:

There is data encoded somewhere, there might be an online decoder

Solution :key:

There are 2 ways I found to solve this problem.

First one, open up the image in stegsolve.jar (can be found here), scroll through some color planes and you’ll see some really small white dots on the top left corner, here’s an example.

We see it on 3 planes:

So let’s “Analyse” and then do “Data Extract”, we select the planes where we found those white dots, then preview it and voila.

Now for the second way, referring to the hint, I tried to google “image steganography decoder” and found this site, we simply just upload the file and “decode” it.

Flag :checkered_flag:

picoCTF{h1d1ng_1n_th3_b1t5}