evyatarmeged / stegextract

Detect hidden files and text in images

Stegextract

Bash script to extract hidden files and strings from images.

Description

Stegextract extracts any trailing data after the image's closing bytes, and any hidden files (or other images) embedded within the image.
Short byte combinations such as JPEG's FFD8 FFE0 might sometimes create false positives.
Manually reviewing the hexdump is sometimes inevitable in cases of highly complex embedded files.
Stegextract is not the solution for any color/pixel/filter/LSB related Steganography, nor does it try to be. It relies on magic numbers, hexdumps and binary data alone.
Currently supports PNG, JPG, and GIF.

Update: --analyze flag was deprecated and is now being performed automatically with every scan.

Installation

sudo sh -c 'curl https://raw.githubusercontent.com/evyatarmeged/stegextract/master/stegextract > /usr/local/bin/stegextract'
sudo chmod +x /usr/local/bin/stegextract

Usage

Usage: stegextract <file> [options]

-h, --help                Print this and exit
-o, --outfile             Specify an outfile
-s, --strings             Extract strings from file
-q, --quiet               Do not output to stdout
--force-format            Force this image format instead of detecting

POC:

Image examples from the above GIF can be found in the examples folder.

stegextract's Issues

does not work on OSX for file names with a space in them.

FOR EXAMPLE:

./stegextract image_name.jpg ---> WORKS

./stegextract image\ name.jpg ---> DOES NOT WORK

clearly this is as easy as just renaming the file you are trying to work with and is not necessarily a problem with stegextract, however I wanted to formally document this here because I a couple hours trying to figure out what I was doing wrong before realizing how simple the problem was xD

/usr/local/bin/stegextract: line 198: strings: command not found

root@PC:/mnt/c# stegextract -s paul-habres-973040-unsplash.jpg
Detected image format: JPG
Extracted trailing file data: Zip archive data, at least v2.0 to extract
Extracting strings...
/usr/local/bin/stegextract: line 198: strings: command not found
Performing deep analysis
Done