Hidden in Plain Sight
An Introduction to
Steganography

Suppose you want to hide the letter A (ASCII 65 = binary 01000001) in a single pixel with RGB values (200, 130, 75).

Original pixel channels in binary:
  R = 200  →  11001000
  G = 130  →  10000010
  B =  75  →  01001011

Message bits to hide: 01000001 (letter 'A')
Replace the LSB of each channel with a message bit:
  R: 1100100[0] → replace with bit 0 → 11001000 = 200  (unchanged)
  G: 1000001[0] → replace with bit 1 → 10000011 = 131  (changed by 1)
  B: 0100101[1] → replace with bit 0 → 01001010 =  74  (changed by 1)

Next 5 bits hidden in next 5 channel values of following pixels.
Result: pixel (200, 131, 74) — visually identical to (200, 130, 75).

Save the following as lab1/encode.py.

from PIL import Image
import numpy as np

def encode_message(input_path, output_path, message):
    """Hide 'message' in the LSB of each RGB channel."""

    img = Image.open(input_path).convert('RGB')
    pixels = np.array(img, dtype=np.uint8)

    # Encode message length (4 bytes) + message + null terminator
    msg_bytes = message.encode('utf-8') + b'\x00'
    msg_bits  = []
    for byte in msg_bytes:
        for i in range(7, -1, -1):        # MSB → LSB
            msg_bits.append((byte >> i) & 1)

    flat = pixels.flatten()              # 1D array of all channel values

    if len(msg_bits) > len(flat):
        raise ValueError("Message too long for this image.")

    for i, bit in enumerate(msg_bits):
        flat[i] = (flat[i] & 0b11111110) | bit  # clear LSB, set to bit

    stego = Image.fromarray(flat.reshape(pixels.shape))
    stego.save(output_path, 'PNG')
    print(f"Encoded {len(msg_bits)} bits into {output_path}")

# ── Run it ───────────────────────────────────────────────────────
encode_message('original.png', 'stego.png', 'Hello, hidden world!')

Save as lab1/decode.py.

from PIL import Image
import numpy as np

def decode_message(stego_path):
    """Extract the message hidden in the LSB of the stego image."""
    img  = Image.open(stego_path).convert('RGB')
    flat = np.array(img).flatten()

    bits = [int(v) & 1 for v in flat]   # extract LSB of every channel

    message = []
    for byte_start in range(0, len(bits) - 7, 8):
        byte_bits = bits[byte_start : byte_start + 8]
        value = 0
        for b in byte_bits:
            value = (value << 1) | b
        if value == 0:              # null terminator found
            break
        message.append(chr(value))

    print("Decoded message:", ''.join(message))

decode_message('stego.png')

from PIL import Image, ImageChops
import numpy as np

original = Image.open('original.png').convert('RGB')
stego    = Image.open('stego.png').convert('RGB')

diff = ImageChops.difference(original, stego)
diff_arr = np.array(diff)

# Amplify by 128 so single-bit changes become visible
amplified = Image.fromarray(np.clip(diff_arr * 128, 0, 255).astype(np.uint8))
amplified.save('diff_amplified.png')

print(f"Max pixel difference: {diff_arr.max()} (should be ≤ 1)")
print(f"Changed pixels: {(diff_arr > 0).sum()}")

Save as lab2/encode_text.py.

def encode_text(cover_text, secret):
    ZWSP = '\u200B'   # bit 0
    ZWNJ = '\u200C'   # bit 1

    # Convert secret to binary string
    bits = ''.join(f'{byte:08b}' for byte in secret.encode('utf-8'))

    # Build invisible payload string
    payload = ''.join(ZWSP if b == '0' else ZWNJ for b in bits)

    # Insert after first word of cover text
    words = cover_text.split(' ', 1)
    if len(words) < 2:
        return cover_text + payload
    return words[0] + payload + ' ' + words[1]

cover  = "The weather today is sunny and warm. Have a great afternoon."
secret = "MEET AT NOON"

result = encode_text(cover, secret)
print("Stego text written to stego.txt")
with open('stego.txt', 'w', encoding='utf-8') as f:
    f.write(result)

def decode_text(stego_text):
    ZWSP = '\u200B'
    ZWNJ = '\u200C'

    bits = ''
    for ch in stego_text:
        if ch == ZWSP: bits += '0'
        elif ch == ZWNJ: bits += '1'

    if not bits:
        print("No hidden data found.")
        return

    # Reassemble bytes
    message = ''
    for i in range(0, len(bits) - 7, 8):
        byte = bits[i:i+8]
        message += chr(int(byte, 2))

    print("Hidden message:", message)

with open('stego.txt', encoding='utf-8') as f:
    decode_text(f.read())

To see the invisible characters in a terminal:

# Hex dump of the stego text (Linux/Mac)
cat stego.txt | xxd | head -20

# Look for: e2 80 8b (ZWSP) and e2 80 8c (ZWNJ) in the hex output
# These sequences should not appear in normal plain text.

In a Python script:

with open('stego.txt', encoding='utf-8') as f:
    text = f.read()
count_zwsp = text.count('\u200B')
count_zwnj = text.count('\u200C')
print(f"ZWSP: {count_zwsp}, ZWNJ: {count_zwnj}")
if count_zwsp + count_zwnj > 0:
    print("⚠ Zero-width characters detected — possible hidden data!")

• Download a WAV file known to contain a spectrogram image. A classic example: search "aphex twin windowlicker spectrogram" — the final track contains a face in the spectrogram. For your lab, use any WAV file your instructor provides.
• Open Audacity. Go to File → Import → Audio and open the WAV file.
• In the track header (left side of the waveform), click the dropdown arrow next to the track name.
• Select Spectrogram. The view changes from a waveform to a colour frequency plot.
• Scroll to the end of the track. If an image has been hidden in the high-frequency range, it will appear here. The default spectrogram may not show high frequencies — adjust: click the dropdown again → Spectrogram Settings → set Maximum Frequency to 22050 Hz.
• Note what you see, and take a screenshot for your lab report.

Save as lab3/spectrogram_encode.py. This generates a WAV file where white pixels in an image are encoded as tones.

import numpy as np
from PIL import Image
import wave, struct

def image_to_spectrogram_wav(image_path, output_wav, duration=5.0,
                               sample_rate=44100, freq_min=1000, freq_max=8000):
    img = Image.open(image_path).convert('L')   # greyscale
    img = img.resize((200, 100))               # 200 time cols × 100 freq rows
    pixels = np.array(img) / 255.0

    n_samples = int(duration * sample_rate)
    audio     = np.zeros(n_samples)

    n_cols, n_rows = pixels.shape[1], pixels.shape[0]
    col_samples = n_samples // n_cols

    for col in range(n_cols):
        start = col * col_samples
        end   = start + col_samples
        t     = np.linspace(0, col_samples / sample_rate, col_samples, endpoint=False)
        for row in range(n_rows):
            amp = pixels[n_rows - 1 - row, col]   # flip: low row = low freq
            if amp > 0.1:
                freq = freq_min + (freq_max - freq_min) * row / n_rows
                audio[start:end] += amp * 0.3 * np.sin(2 * np.pi * freq * t)

    # Normalise and write WAV
    audio = np.clip(audio / np.max(np.abs(audio) + 1e-9), -1, 1)
    audio_int = (audio * 32767).astype(np.int16)

    with wave.open(output_wav, 'w') as wf:
        wf.setnchannels(1)
        wf.setsampwidth(2)
        wf.setframerate(sample_rate)
        wf.writeframes(audio_int.tobytes())
    print(f"Wrote {output_wav}")

# Create a small test image (white text on black background) then:
image_to_spectrogram_wav('message.png', 'hidden_audio.wav')

• Obtain any JPEG photo — photo.jpg. Create a text file to hide: echo "Secret: lab access code 4729" > secret.txt
• Embed the file:
  

  steghide embed -cf photo.jpg -sf stego.jpg -p "my_passphrase"
  # -cf  cover file (original)
  # -sf  stego file (output)
  # -p   passphrase

• Confirm the embed worked — check the file info:
  

  steghide info stego.jpg

• Compare file sizes:
  

  ls -lh photo.jpg stego.jpg
  # The stego file will be slightly different in size

# Extract to current directory
steghide extract -sf stego.jpg -p "my_passphrase"

# Verify the file came out intact
cat secret.txt

Share stego.jpg with a classmate. Give them the passphrase separately (over a different channel). They should be able to extract the file successfully.

# Try extracting without the correct passphrase
steghide extract -sf stego.jpg -p "wrong_password"
# Steghide will either fail silently or produce garbage — note the result.

# Even knowing steganography was used, without the key the data is inaccessible.
# This illustrates the combination of steganography + cryptography.

# Read all metadata from a JPEG
exiftool photo.jpg

# Read specific fields only
exiftool -Comment -Artist -GPSLatitude -GPSLongitude photo.jpg

# Read ALL fields, including obscure ones
exiftool -a -u -g1 photo.jpg

# Write a message to the Comment field
exiftool -Comment="Meeting confirmed: Tuesday 14:00, Gate 7" photo.jpg

# Multiple fields
exiftool -Artist="John Smith" \
         -Copyright="© 2024" \
         -Comment="PAYLOAD: dXNlcjpwYXNzd29yZA==" \
         photo.jpg

# Verify it was written
exiftool -Comment photo.jpg

For binary data, encode it as base64 first so it survives the text field without corruption:

# Encode a secret file as base64
base64 secret.txt > secret.b64

# Store in EXIF Comment
exiftool -Comment="$(cat secret.b64)" photo.jpg

# ── On the receiving end ──
exiftool -Comment -b photo.jpg | base64 -d > recovered_secret.txt
cat recovered_secret.txt

# Remove ALL metadata from an image
exiftool -all= photo.jpg

# Or with mat2 — installed via apt on Kali (NOT pip)
mat2 photo.jpg

Many organisations strip EXIF data from all images before publishing them on the web — both for privacy (removing GPS coordinates) and to prevent covert channels.

• Create a ZIP file: zip secret_archive.zip secret.txt
• Rename it: cp secret_archive.zip disguised.jpg
• Try opening it: eog disguised.jpg — the image viewer will refuse to open it, or crash.
• Detect the real type:

  file disguised.jpg
  # Output: disguised.jpg: Zip archive data, at least v2.0 to extract
  # The 'file' command reads the magic bytes, ignoring the extension.

• Inspect in hex:

  xxd disguised.jpg | head -3
  # You will see: 50 4b 03 04  (PK.. — ZIP magic bytes)
  # NOT ff d8 ff  (JPEG magic bytes)

def identify_file(filepath):
    SIGNATURES = {
        b'\xff\xd8\xff'      : 'JPEG image',
        b'\x89PNG\r\n\x1a\n' : 'PNG image',
        b'PK\x03\x04'        : 'ZIP archive (could be DOCX/XLSX/JAR)',
        b'%PDF'              : 'PDF document',
        b'MZ'                : 'Windows executable (EXE/DLL)',
        b'\x7fELF'           : 'Linux ELF binary',
        b'ID3'               : 'MP3 audio',
        b'RIFF'              : 'WAV/AVI',
    }

    with open(filepath, 'rb') as f:
        header = f.read(16)

    print(f"\nFile: {filepath}")
    print(f"Extension claims: {filepath.rsplit('.',1)[-1].upper()}")
    print(f"First 16 bytes (hex): {header.hex()}")

    for sig, name in SIGNATURES.items():
        if header.startswith(sig):
            print(f"Actual type: {name} ✓")
            return
    print("Actual type: Unknown / no matching signature")

identify_file('disguised.jpg')
identify_file('photo.jpg')

A polyglot file is a file that is simultaneously valid in two formats.

# Append a ZIP to the end of a JPEG — both formats stay valid
cat photo.jpg secret_archive.zip > polyglot.jpg

# Opens normally as a JPEG in image viewers
# But also works as a ZIP:
unzip polyglot.jpg
# ZIP readers scan from the END of the file for the ZIP central directory
# JPEG readers scan from the START — they ignore everything after the image data

Write an innocent paragraph whose first letter of each word spells out a short message. For example, encode CALL ME:

Now write your own. Encode the message STEG IS FUN as a paragraph of at least 3 sentences. The first letter of each word should spell it out. It must read naturally.

Save as lab7/null_cipher.py.

import re

def extract_first_letters(text):
    words = re.findall(r"[A-Za-z]+", text)
    return ''.join(w[0].upper() for w in words)

def extract_nth_letter(text, n=3):
    words = re.findall(r"[A-Za-z]+", text)
    return ''.join(w[n-1].upper() for w in words if len(w) >= n)

def extract_acrostic(text):
    sentences = re.split(r'(?<=[.!?])\s+', text.strip())
    return ''.join(s[0].upper() for s in sentences if s)

def extract_every_nth_char(text, n=5):
    letters = [c.upper() for c in text if c.isalpha()]
    return ''.join(letters[i] for i in range(n-1, len(letters), n))

# WWI example — first letters of each word spell the secret
wwi = ("Apparently neutral's protest is thoroughly discounted and ignored. "
       "Isman hard hit. Blockade issue affects pretext for embargo on "
       "by-products, ejecting suets and vegetable oils.")

print("First letters:", extract_first_letters(wwi))
print("Every 5th char:", extract_every_nth_char(wwi, 5))

# Acrostic poem
poem = ("Shadows fall across the evening sky. "
        "Echoes travel far beyond the hills. "
        "Candles flicker in the winter wind. "
        "Rain will come before the morning light. "
        "Each dawn begins a chapter fresh and new. "
        "Tomorrow waits with patience for us all.")

print("Acrostic:", extract_acrostic(poem))

def brute_force(text):
    print("\n── Brute-force extraction ──")
    print("First letter of each word:", extract_first_letters(text))
    print("Acrostic (per sentence):  ", extract_acrostic(text))
    for n in [2, 3, 4, 5]:
        print(f"Every {n}th char: ", extract_every_nth_char(text, n))
        print(f"  {n}th letter of each word: ", extract_nth_letter(text, n))