repository·master·Indexed 26 days ago
https://github.com/kurolabs/stegcloakA pure JavaScript steganography module (v1.1.1) designed in a functional programming style to hide text within cover text using invisible Unicode characters. It features AES-256-CTR encryption, HMAC integrity checks, and text compression. StegCloak is available as both a Node.js API and a CLI tool for covert communication and watermarking.
You can install StegCloak either globally to use it as a CLI tool or locally as a dependency in your Node.js project.
Global installation (for CLI usage):
$ npm install -g stegcloakLocal installation (for API usage):
$ npm install stegcloakStegCloak can be used as a module in your JavaScript applications. It uses a functional style and supports AES-256-CTR encryption and HMAC integrity checks.
Initialize the instance by passing boolean flags for encryption and integrity. These flags determine how the hide method behaves.
const StegCloak = require('stegcloak');
// Initializes with encryption true and hmac false for hiding
const stegcloak = new StegCloak(true, false);Note: You can change stegcloak.encrypt and stegcloak.integrity booleans later to modify behavior.
Use stegcloak.hide(secret, password, cover) to return a string containing the cover text with the secret embedded invisibly.
const magic = stegcloak.hide("Voldemort is back", "mischief managed", "The WiFi's not working here!");
console.log(magic); // Output: The WiFi's not working here!Use stegcloak.reveal(data, password) to extract the secret. The method automatically detects if encryption or integrity checks were used during the hiding process.
const secret = stegcloak.reveal(magic, "mischief managed");
console.log(secret); // Output: Voldemort is backconst StegCloak = require('stegcloak');
const stegcloak = new StegCloak(true, false);
const magic = stegcloak.hide("Voldemort is back", "mischief managed", "The WiFi's not working here!");
const secret = stegcloak.reveal(magic, "mischief managed");
console.log(secret); // Voldemort is backBoth hide and reveal commands support a --config <config> flag to load settings from a JSON file. This is useful for automation or avoiding interactive prompts.
For hide command, the JSON must contain:
secret: The text to hide.cover: The text to hide within.password (optional): The encryption password. If omitted, STEGCLOAK_PASSWORD env var is used.integrity (optional): Boolean for tampering protection.nocrypt (optional): Boolean to disable encryption.output (optional): Path to the output file.For reveal command, the JSON must contain:
message: The payload to decrypt.password (optional): The decryption password.output (optional): Path to the output file.STEGCLOAK_PASSWORD environment variable.The stegcloak reveal command extracts the hidden secret from a piece of text.
Usage:
stegcloak reveal [message]
Options:
-f, --file <file>: Extract message from file-cp, --clip: Copy message directly from clipboard-o, --output <output>: Stream the secret to an output file-c, --config <file>: Config file-h, --help: Display help for command$ stegcloak revealThe stegcloak hide command embeds a secret into a cover text using invisible Unicode characters.
Usage:
stegcloak hide [options] [secret] [cover]
Options:
-fc, --fcover <file>: Extract cover text from file-fs, --fsecret <file>: Extract secret text from file-n, --nocrypt: If you don't need encryption (default: false)-i, --integrity: If additional security of preventing tampering is needed (default: false)-o, --output <output>: Stream the results to an output file-c, --config <file>: Config file-h, --help: Display help for command$ stegcloak hideThe StegCloak constructor accepts two boolean parameters to control the security level of the cloaking process:
| Parameter | Type | Default | Description |
|---|---|---|---|
_encrypt | boolean | true | If true, the secret is encrypted with the provided password before being embedded. |
_integrity | boolean | false | If true, an integrity check (HMAC) is applied to ensure the secret hasn't been tampered with. |
If _encrypt is set to false, the message will be compressed and cloaked but not encrypted.
The StegCloak class provides a high-level API for compressing, encrypting, and cloaking secrets within a cover text using invisible characters (Zero Width Characters).
When instantiating StegCloak, you can configure two optional behaviors:
_encrypt (boolean, default: true): Whether to encrypt the secret using the provided password._integrity (boolean, default: false): Whether to include an integrity check (HMAC) during the process.Use the hide(message, password, cover) method.
message: The secret string you want to hide.password: The password used for encryption.cover: The visible text used as a carrier. Note: The cover text must contain at least two words (separated by a space).Use the reveal(secret, password) method.
secret: The cloaked text (the output from hide).password: The password used during the hiding process.Returns the original decrypted and decompressed message.
The hide [secret] [cover] command supports the following options:
| Flag | Long Flag | Description |
|---|---|---|
-fc | --fcover <fcover> | Extract cover text from a file |
-fs | --fsecret <fsecret> | Extract secret text from a file |
-n | --nocrypt | Disable encryption (use if encryption is not needed) |
-i | --integrity | Enable additional security to prevent tampering |
-o | --output <output> | Stream the results to an output file |
-c | --config <config> | Use a JSON configuration file |
Environment Variable:
STEGCLOAK_PASSWORD: If set, this password will be used automatically, bypassing the interactive password prompt.The reveal [message] command supports the following options:
| Flag | Long Flag | Description |
|---|---|---|
-f | --file <file> | Extract message to be revealed from a file |
--clip | --clip | Copy message directly from the clipboard |
-o | --output <output> | Stream the secret to an output file |
-c | --config <config> | Use a JSON configuration file |
Environment Variable:
STEGCLOAK_PASSWORD: If set, this password will be used automatically for decryption.Use the reveal command to extract a secret message from a payload. The payload can be provided as a command argument, read from a file, or taken directly from the clipboard.
Key behaviors:
--clip), the CLI will prompt for the password (unless STEGCLOAK_PASSWORD is set).--output, the revealed secret will be written to that file instead of just being printed to the terminal.Use the hide command to embed a secret message within a cover text. By default, the resulting payload is copied to your clipboard. You can provide the secret and cover text as arguments, via files, or through interactive prompts.
Key behaviors:
STEGCLOAK_PASSWORD environment variable is set.