Some data does not hide its contents — it hides the fact that it exists at all. An ordinary-looking photograph of a sunset can carry a secret message tucked invisibly among its pixels, and nothing about the image gives the secret away. This is steganography: concealing a payload inside an innocent carrier file.
It is worth fixing the distinction up front, because it is the heart of this lesson:
- Encryption hides the contents of a message. You can see that a message exists; you just cannot read it without the key.
- Steganography hides the existence of the message. The carrier looks completely ordinary, so an observer does not even suspect there is anything to read.
The two are complementary, and the strongest approach combines them — encrypt the payload first, then hide the ciphertext. But for a defender the warning is the reverse: hiding data is not the same as protecting it. If the only thing keeping an attacker out is that they have not noticed where you put the data, you have no real control at all. That anti-pattern has a name — security through obscurity — and this lesson shows why it fails.
In this lesson you will:
- Distinguish steganography (hiding the existence of a message) from encryption (hiding its contents).
- Learn the common carriers and embedding tricks — least-significant-bit pixels, data appended after the end of a file, metadata fields, and layered encoding.
- Use a tool such as
steghide,binwalk, orzstegto look for data hidden inside an image. - Understand why security through obscurity is not security, via Kerckhoffs's principle.
Estimated time: 10 to 15 minutes.
Note on the target: NovaCart files these under Security through Obscurity and demonstrates them on its Photo Wall (/vuln/nebula-photos) through the Steganography and Nested Easter Egg challenges. If you completed the EXIF lesson, you have already visited this page to inspect GPS metadata — the same images can also carry hidden stego payloads. The exact images, passphrases, and routes are version-dependent, so the lesson also includes a self-created carrier exercise — the extraction technique works against any carrier you create yourself.
When you are ready, send the Continue signal.