Steganography CTF: Find the Hidden Evidence

This lab combines the representation work from Week 10, classical-crypto reasoning from Week 11, and file analysis from this week.

All artifacts are teacher-provided and synthetic.

Do not upload personal images, inspect real classmates' files, or execute extracted content.

Challenge workflow

Use the same evidence process for every artifact:

identify → inspect → hypothesize → test → extract → interpret → document

Identify

What file type does the lab claim this is?

Inspect

Review supplied metadata, file size, byte view, and teacher-approved tool output.

Hypothesize

Where might additional data exist?

Test

Use the approved inspection or extraction method.

Extract

Recover only the classroom payload.

Interpret

Determine whether the payload is plain text, encoded text, or another supplied artifact.

Document

Record the evidence path.

Challenge 1: metadata flag

A fictional image contains a metadata comment.

Your task:

• locate the metadata field
• recover the flag
• record which evidence proved the flag was present

Example flag format:

GSC{metadata_is_data}

Challenge 2: appended bytes

A second image previews normally, but the teacher-provided hex view contains additional readable content near the end of the file.

Record:

• offset
• byte sequence
• text interpretation
• why normal previewing missed it

Challenge 3: embedded payload

A teacher-prepared carrier contains a hidden text payload using an approved classroom steganography tool.

The lab may provide a bounded extraction command or browser interface.

If a command is supplied, run exactly the approved command against the supplied artifact.

Do not generalize the exercise into searching arbitrary files.

Record:

• carrier identifier
• extraction method
• recovered payload
• whether a passphrase was supplied by the lab
• what the extraction proves

Challenge 4: layered flag

The extracted payload is not immediately readable.

It may contain Base64 or hex encoding from Week 10.

Use a transformation ledger:

Stop if a layer produces an executable, URL, or anything outside the stated lab objective.

Tool comparison

The curriculum references tools such as CyberChef, hex editors, steghide, metadata viewers, and binwalk-style inspection.

The goal is not to memorize tool names.

Compare what each category helps you answer:

False-positive challenge

One artifact has a larger file size but contains no hidden classroom message.

Explain why the size difference alone was not enough evidence.

This matters because analysts can find a suspicious clue and then force every later observation to support the first theory.

Build the investigation record

For each challenge, include:

Initial clue

What made you inspect further?

Tool or method

What approved method did you use?

Evidence

What exact output supports the conclusion?

Interpretation

What does the evidence mean?

Limitation

What does it not prove?

Final CTF defense

Choose the hardest challenge and explain it to another student without showing the answer first.

Your explanation should give enough structural hints to teach the method:

• inspect metadata
• compare file structure
• check supplied byte offsets
• identify encoding layers

Do not simply reveal the flag.

Evidence for Lesson 3

Submit:

• four challenge investigation records
• layered transformation ledger
• tool-category comparison
• false-positive analysis
• one peer teaching note

Finish with:

The strongest evidence of hidden data was ________, not ________.

Steganography analysis is not guessing that every image hides a secret. It is building an evidence trail from artifact structure to a reproducible extraction result.