zsteg

Analyze image

$ zsteg [image.png]

$ zsteg -a [image.png]

$ zsteg -E "[b1,rgb,lsb]" [image.png]

$ zsteg -v [image.png]

$ zsteg [image.bmp]

$ zsteg --limit [1000] [image.png]

zsteg [-a] [-v] [-E extract] [options] image

zsteg detects and extracts data hidden through steganography in PNG and BMP image files. It analyzes multiple color channels (RGB, alpha, and individual colors) across various bit depths to identify concealed content such as text, embedded files, and binary patterns.
The tool's primary focus is LSB (Least Significant Bit) steganography, where data is hidden in the least significant bits of pixel color values. The -a flag performs a comprehensive check across all common methods and channel combinations, while the -E flag extracts data from a specific channel and bit configuration.
zsteg is widely used in CTF (Capture The Flag) competitions for solving steganography challenges and in forensic analysis of suspicious image files. It is written in Ruby.

-a, --all

Check all methods.

Verbose output.

Extract data.

Output limit.

Output file.

Bits to check.

Bit order.

PNG and BMP only. False positives possible. Requires Ruby.

zsteg was created for CTF competitions and steganography analysis. It provides quick detection of hidden image data.

steghide(1), binwalk(1), exiftool(1)