stego-toolkit

Before deep analysis, use these command-line tools to get a broad overview of a file's type, metadata, or embedded content:

• file: Check file type.
• exiftool: Check media metadata.
• binwalk: Check for embedded or appended files.
• strings: Look for readable characters.
• foremost: Carve out embedded/appended files.
• pngcheck: Get PNG details or verify integrity.
• identify: Check image type and corruption (requires GraphicMagick).
• ffmpeg: Check audio integrity and report errors.

file stego.jpg
exiftool stego.jpg
binwalk stego.jpg
strings stego.jpg
foremost stego.jpg
pngcheck stego.png
identify -verbose stego.jpg
ffmpeg -v info -i stego.mp3 -f null -

When brute forcing steganography, use targeted wordlists rather than massive standard ones. Use these tools to generate them:

• John the Ripper: Expand existing wordlists using rules.
  • Extensive rules (~x1000): john -wordlist:/path/to/your/wordlist -rules:Single -stdout > /path/to/expanded/wordlist
  • Reduced rules (~x50): john -wordlist:/path/to/your/wordlist -rules:Wordlist -stdout > /path/to/expanded/wordlist
• Crunch: Generate wordlists based on patterns.
  • Example (6-char password ending in 1984): crunch 6 6 abcdefghijklmnopqrstuvwxyz -t @@1984
• CeWL: Scrape websites for relevant words.
  • Example: cewl -d 0 -m 8 https://en.wikipedia.org/wiki/Donald_Trump (extracts strings $\ge$ 8 characters).

Since Docker containers do not have an X11 server by default, you can run GUI tools by using SSH X11 forwarding.

Requirements:

• Linux: Likely already has X11.
• macOS: Requires Xquartz (brew install Xquartz).
• Windows: Not natively supported via this method.

Steps:

1. Start the container and expose port 22: docker run -it --rm -p 127.0.0.1:22:22 dominicbreuker/stego-toolkit /bin/bash.
2. Inside the container, run start_ssh.sh (the script will print a password).
3. From your host machine, connect using SSH with the -X flag to enable X11 forwarding.

# in 1st host shell
docker run -it --rm -p 127.0.0.1:22:22 dominicbreuker/stego-toolkit /bin/bash

# inside container shell
start_ssh.sh

# in 2nd host shell (use it to launch GUI apps afterwards)
ssh -X -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no root@localhost

You can automate workflows using pre-built scripts for specific file types. There are two types of scripts:

• XXX_check.sh <stego-file>: Runs basic screening tools and generates a report.
• XXX_brute.sh <stego-file> <wordlist>: Attempts to extract messages using a wordlist and various tools.

Supported File Types:

• JPG:
  • check_jpg.sh (Note: source says .h, likely .sh)
  • brute_jpg.sh (Runs steghide, outguess, outguess-0.13, stegbreak, and stegoveritas.py -bruteLSB)
• PNG:
  • check_png.sh
  • brute_png.sh (Runs openstego and stegoveritas.py -bruteLSB)

Use these tools to perform statistical tests to find irregularities that suggest hidden messages:

• stegoveritas.py: Performs a wide variety of checks on JPG, PNG, GIF, TIFF, and BMP. Runs LSB brute force and creates transformed images.
• zsteg: Detects LSB steganography in PNG and BMP files.
• stegdetect: Performs statistical tests on JPG files to identify specific tools (jsteg, outguess, jphide, etc.).
• stegbreak: Brute force cracker for JPG images (supports outguess, jphide, and jsteg).

stegoveritas.py stego.jpg
zsteg -a stego.jpg
stegdetect stego.jpg
stegbreak -t o -f wordlist.txt stego.jpg

To use graphical user interface (GUI) tools within the container, you can use one of the following two methods:

1. X11 Forwarding: Run start_ssh.sh and connect to your container using X11 forwarding.
2. VNC/Browser: Run start_vnc.sh and connect to the container's desktop environment directly through your web browser.

GUI tools cannot be used directly via the command line. To use them inside the container, you must provide an X11 interface:

1. VNC (Recommended): Run start_vnc.sh. Connect via your browser to port 6901 to access an Xfce desktop. This has no host dependencies.
2. SSH: Run start_ssh.sh. Connect using X11 forwarding. This requires an X11 server installed on your host machine.

Supported GUI tools include steg, steganabara, stegsolve, sonic-visualiser, stegosuite, openpuff, deepsound, and cloackedpixel-analyse.

To avoid X11 dependencies, you can use the built-in TigerVNC server and noVNC client to access the container's Xfce desktop via an HTML5 VNC session in your web browser.

Steps:

1. Start the container and expose port 6901: docker run -it --rm -p 127.0.0.1:6901:6901 dominicbreuker/stego-toolkit /bin/bash.
2. Inside the container, run start_vnc.sh (the script will print a password).
3. Open your browser and navigate to http://localhost:6901/?password=<password_from_start_vnc>.

# in 1st host shell
docker run -it --rm -p 127.0.0.1:6901:6901 dominicbreuker/stego-toolkit /bin/bash

# inside container shell
start_vnc.sh

# in browser, connect with: http://localhost:6901/?password=<password_from_start_vnc>