From ctf-kit
Assists in solving steganography challenges in CTF by analyzing images (PNG,JPEG,BMP,GIF), audio (WAV,MP3) for hidden data via metadata, LSB, spectrograms using zsteg, steghide, exiftool, binwalk.
How this agent operates — its isolation, permissions, and tool access model
Agent reference
ctf-kit:agents/claude/commands/ctf-stegoThe summary Claude sees when deciding whether to delegate to this agent
Help solve steganography challenges. Use this command when: - Challenge involves images (PNG, JPEG, BMP, GIF) - Audio files (WAV, MP3, FLAC) - Hidden data in media files - Challenge mentions "hidden" or "invisible" data - **LSB (Least Significant Bit)**: Data hidden in pixel values - **Metadata**: EXIF data, comments - **File appending**: Data after EOF marker - **Color channels**: Hidden in sp...
Help solve steganography challenges.
Use this command when:
# Check available tools
ctf check --category stego
# PNG/BMP analysis
zsteg image.png
zsteg -a image.png # all combinations
# JPEG steganography
steghide extract -sf image.jpg
# Metadata
exiftool image.jpg
# Check for embedded files
binwalk image.png
# View hex
xxd image.png | head -50
Check metadata first
exiftool image.jpg
strings image.jpg | head -50
Look for appended data
binwalk image.png
xxd image.png | tail -20
Try common stego tools
zsteg -a image.pngsteghide extract -sf image.jpgAnalyze bit planes
For audio
# All checks
zsteg -a image.png
# Specific extractions
zsteg -E "b1,rgb,lsb,xy" image.png # LSB of RGB
zsteg -E "extradata:0" image.png # Trailing data
# Common patterns
zsteg image.png | grep -i "text\|flag\|ascii"
# Extract with empty password
steghide extract -sf image.jpg -p ""
# Extract with password
steghide extract -sf image.jpg -p "password"
# Info about file
steghide info image.jpg
from PIL import Image
def extract_lsb(image_path):
img = Image.open(image_path)
pixels = list(img.getdata())
bits = ""
for pixel in pixels:
for channel in pixel[:3]: # RGB
bits += str(channel & 1)
# Convert bits to bytes
chars = [chr(int(bits[i:i+8], 2)) for i in range(0, len(bits), 8)]
return ''.join(chars)
When responding to /ctf.stego:
/ctf.analyze - Initial file analysis/ctf.forensics - For file carvingnpx claudepluginhub mysterionrise/ctf-kitFetches up-to-date library and framework documentation from Context7 for questions on APIs, usage, and code examples (e.g., React, Next.js, Prisma). Returns concise summaries.
Expert in strict POSIX sh scripting for portable Unix-like systems. Delegate for shell scripts compatible with dash, ash, sh, bash --posix, featuring safe argument parsing, error handling, and cross-platform ops.
Elite code reviewer for modern AI-powered code analysis, security vulnerability detection, performance optimization, and production reliability. Masters static analysis tools and security scanning.