#steganography
7 writeups · all writeups
A Message Has Three Dates
I built a six-stage stego challenge where the key sat in Discord rather than in the file. Nobody solved it. Here is the whole chain, and the reason it broke at the first gate.
Lost at Sea — Athena Trace 2026 Writeup
A four-stage chain: read vessel data off a screenshot, derive an AES key from it, pull a ZIP out of the tail of a PNG, and unlock it with the ship's own call sign.
The Bitplane Combination Your Scanner Can't Express
Every mainstream LSB scanner applies one bit index across all three channels. Payloads that don't follow that rule are invisible by construction — not by accident.
Not here any more — A Payload No Scanner Can See
zsteg, Aletheia and five statistical detectors all called this file clean. The ZIP was sitting at offset 0 the whole time — hidden by splitting one bitstream across three different bitplanes.
READONLY — The Man Who Escaped Reality
A hand-drawn QR code carries two payloads: one is the vault, the other is the keys. The chain opens as a supermax jailbreak and closes somewhere much stranger.
Nothing To See Here — PDF → Mastodon → SSTV → QR
A passive-OSINT challenge that chains white-on-white PDF text, an emoji substitution cipher, a Morse-tagged Robot 36 SSTV transmission and a QR code into a physical meeting location.
packet.bspak — Three Channels, Two Decoys, One Stereogram
Breaking a layered OSINT packet: binary-ASCII JSON, a QR code that isn't a QR code, and a Vocaroo spectrogram that hands you a Google Maps pin.