detection

Overview

Reading perceptual clues gets you far, but the reliable heart of stego work is structural detection: examining the actual bytes and structure of a file with tools rather than your senses. This lesson covers the workhorse techniques — identifying a file's true type, scanning for embedded or appended files, inspecting the hex tail, and reading statistical signals — so you can confirm that data is hidden and learn where.

Learning objectives

• Verify a file's true type instead of trusting its extension.
• Detect appended and embedded files with binwalk and hex inspection.
• Recognize correct format signatures (magic bytes) and end markers.
• Use statistical signals to flag likely LSB embedding.

Core concept

Files declare their type through a magic number — a short, fixed byte sequence at the very start. A viewer trusts that signature, not the filename. Detection exploits the gap between what a file claims to be and what its bytes actually contain. If a PNG's bytes hold a second, complete file sitting after the image's end marker, the picture still displays fine while carrying a stowaway. Structural detection is the disciplined process of finding these discrepancies.

The core question at this stage is simple: is there more in this file than its format should contain? Answering it does not require guessing the extraction method yet — only proving that something extra is present and locating it.

How it works

1. Identify the true type. The file command reads the magic bytes and reports the format regardless of the extension. A file named photo.png that file reports as a ZIP archive is an immediate red flag. Knowing the real format tells you which end marker to look for.

2. Know the signatures. Correct magic bytes and end markers let you read a hex dump by eye. Common, verifiable signatures include:

• PNG starts with 89 50 4E 47 0D 0A 1A 0A and its data ends with the IEND chunk 49 45 4E 44 AE 42 60 82.
• JPEG starts with FF D8 FF and ends with FF D9.
• GIF starts with 47 49 46 38 ("GIF8").
• ZIP starts with 50 4B 03 04 ("PK..").
• PDF starts with 25 50 44 46 ("%PDF").
• gzip starts with 1F 8B.

If you see a ZIP signature 50 4B 03 04 sitting after a PNG's 49 45 4E 44 AE 42 60 82 end marker, an archive has been appended.

3. Scan for embedded files. The binwalk tool scans a file for the signatures of other known formats anywhere inside it. It reports offsets where it recognizes, say, a ZIP header or another image embedded in the carrier — the fastest way to discover appended or nested files.

4. Inspect the hex tail. Because appended data lives after the end marker, dumping the last portion of the file in hex (with a hex viewer) often shows the extra bytes directly — a recognizable signature, plain-text strings, or an archive header past where the file "should" have stopped.

5. Read statistical signals. LSB embedding disturbs the randomness of the low-order bits. Tools designed for stego analysis measure these statistics and flag images whose bit distributions look unnatural, pointing to probable LSB payloads even when nothing is visible.

Practical example

You receive cat.png. Running file cat.png reports it as PNG data, so far so good. But binwalk cat.png lists two findings: a PNG image at offset 0 and a Zip archive at a later offset. Curious, you view the hex tail and see the bytes 50 4B 03 04 — the ZIP signature — appearing after the PNG's 49 45 4E 44 AE 42 60 82 IEND marker. That confirms a complete ZIP file was glued onto the end of the image. The picture displays normally because PNG viewers stop reading at IEND, but the archive is unmistakably present in the bytes. Detection is done; extraction (covered next) is now a targeted step, not a guess.

Cybersecurity relevance

These are the same first moves a malware analyst or forensic investigator makes on an unknown file: confirm the real type, look for concatenated or embedded content, and check for statistical anomalies. Attackers hide second-stage payloads or exfiltrated data inside media precisely because casual inspection is fooled by the extension and the working preview. file, binwalk, hex inspection, and statistical analysis are staples of real forensic toolkits, and correctly reading magic bytes is a durable skill for triaging any suspicious file — not just CTF challenges.

Common mistakes

• Trusting the extension. A .png name proves nothing; always confirm with the magic bytes.
• Only looking at the start of a file. Appended data hides at the end, past the format's end marker.
• Misremembering signatures. Reading hex by eye only helps if you know the correct bytes; verify against a reference rather than guessing.
• Stopping at "something is here." Detection locates the hidden data; you still need safe, correct extraction.

Key takeaways

• Files declare their type with magic bytes; detection finds the gap between the declared type and the real byte content.
• Use file to confirm the true type, binwalk to scan for embedded/appended files, and a hex viewer to inspect the tail.
• Know correct signatures — PNG 89 50 4E 47 0D 0A 1A 0A / IEND 49 45 4E 44 AE 42 60 82, JPEG FF D8 FF…FF D9, ZIP 50 4B 03 04, PDF 25 50 44 46.
• Statistical analysis of low-order bits can flag likely LSB embedding even when nothing is visible.

Check your understanding

• Why is the file command more trustworthy than a filename for identifying a carrier?
• Where in a carrier would you look for appended data, and which signature would reveal an appended ZIP archive?
• What does a statistical anomaly in an image's least significant bits suggest?