mirror of
https://github.com/elder-plinius/STEGOSAURUS-WRECKS.git
synced 2026-06-07 23:23:57 +02:00
Add files via upload
This commit is contained in:
pliny
@@ -120,6 +120,68 @@ All new examples (Plinian divider series) encode the secret message:
|
||||
| `example_capitalization.txt` | Letter case encoding | Plinian divider in word-initial capitalization (lower=0, upper=1) |
|
||||
| `example_silence_interval.wav` | Audio silence timing | Plinian divider in silence gap durations (short=0, long=1) |
|
||||
|
||||
## More Unicode & Text Tricks (Plinian Divider)
|
||||
|
||||
| File | Technique | What's Hidden |
|
||||
|------|-----------|---------------|
|
||||
| `example_directional_override.txt` | Bidi overrides (RLO/LRO) | Plinian divider in directional control chars with PDF cancellation |
|
||||
| `example_hangul_filler.txt` | Hangul filler (U+3164) | Plinian divider in Korean invisible filler vs regular space |
|
||||
| `example_braille.txt` | Braille patterns (U+2800) | Plinian divider bytes mapped to Braille Unicode block |
|
||||
| `example_math_alphanumeric.txt` | Math bold (U+1D400) | Plinian divider in normal vs mathematical bold letter substitution |
|
||||
| `example_normalization.txt` | NFC vs NFD | Plinian divider in Unicode normalization form choice per word |
|
||||
| `example_sentence_length.txt` | Sentence word count | Plinian divider in odd (=1) vs even (=0) word count sentences |
|
||||
| `example_word_choice.txt` | Synonym substitution | Plinian divider in synonym A (=0) vs synonym B (=1) selection |
|
||||
| `example_misspelling.txt` | Typo patterns | Plinian divider in correct (=0) vs deliberately misspelled (=1) words |
|
||||
|
||||
## More Network Protocol Steganography (Plinian Divider)
|
||||
|
||||
| File | Technique | What's Hidden |
|
||||
|------|-----------|---------------|
|
||||
| `example_ttl_covert.pcap` | IP TTL covert channel | Plinian divider bytes encoded directly in IP TTL field values |
|
||||
| `example_ipid_covert.pcap` | IP ID field encoding | Plinian divider 2 bytes per packet in IP Identification field |
|
||||
| `example_tcp_window.pcap` | TCP window size | Plinian divider 2 bytes per packet in TCP window size field |
|
||||
| `example_tcp_urgent.pcap` | TCP urgent pointer | Plinian divider in TCP URG pointer with URG flag set |
|
||||
| `example_dns_txt.pcap` | DNS TXT record | Plinian divider base64-encoded in DNS TXT response record |
|
||||
| `example_covert_timing.pcap` | Covert timing channel | Plinian divider in inter-packet delays (10ms=0, 50ms=1) |
|
||||
| `example_multibase.txt` | Multi-base encoding | Plinian divider in base16, base32, base64, and base85 |
|
||||
| `example_morse.txt` | Morse code | Plinian divider encoded in dot-dash Morse alphabet |
|
||||
|
||||
## Advanced Image Techniques (Plinian Divider)
|
||||
|
||||
| File | Technique | What's Hidden |
|
||||
|------|-----------|---------------|
|
||||
| `example_pvd.png` | Pixel Value Differencing | Plinian divider in adjacent pixel pair difference parity |
|
||||
| `example_histogram_shift.png` | Histogram shifting | Plinian divider via peak pixel value shifting (peak=0, peak+1=1) |
|
||||
| `example_lsb_4bit.png` | LSB 4-bit per channel | Plinian divider using 4 lower bits per channel (high capacity) |
|
||||
| `example_lsb_msb_first.png` | LSB MSB-first ordering | Plinian divider with reversed bit extraction order per byte |
|
||||
| `example_bmp_dib.bmp` | BMP DIB header fields | Plinian divider in reserved header bytes + trailing data |
|
||||
| `example_gif_disposal.gif` | GIF disposal method | Plinian divider in frame disposal flag bits |
|
||||
| `example_jpeg_app.jpg` | JPEG APP segment | Plinian divider in custom APP14 segment (ST3GG identifier) |
|
||||
| `example_ycbcr.png` | YCbCr color space | Plinian divider in Cb chrominance channel LSB after RGB conversion |
|
||||
| `example_png_chunks_custom.png` | PNG custom chunks | Plinian divider in private stEg/sT3g ancillary PNG chunks |
|
||||
|
||||
## More Document & Archive Techniques (Plinian Divider)
|
||||
|
||||
| File | Technique | What's Hidden |
|
||||
|------|-----------|---------------|
|
||||
| `example_pdf_javascript.pdf` | PDF JavaScript | Plinian divider base64 in OpenAction JavaScript |
|
||||
| `example_pdf_incremental.pdf` | PDF incremental update | Plinian divider in appended incremental update annotation |
|
||||
| `example_pdf_forms.pdf` | PDF form fields | Plinian divider in hidden form field default values |
|
||||
| `example_html_events.html` | HTML event handlers | Plinian divider in onclick, onload, onmouseover attributes |
|
||||
| `example_xml_entities.xml` | XML entity declarations | Plinian divider in DOCTYPE entity definitions + per-byte entities |
|
||||
| `example_nested.zip` | Nested ZIP archive | Plinian divider in inner ZIP comment + secret.txt inside ZIP-in-ZIP |
|
||||
| `example_emoji_skin_tone.txt` | Emoji skin tone selectors | Plinian divider in skin tone modifier choice (4 tones = 2 bits) |
|
||||
| `example_punycode.txt` | Punycode/IDN domains | Plinian divider bytes encoded as internationalized domain names |
|
||||
|
||||
## Final Techniques (Plinian Divider)
|
||||
|
||||
| File | Technique | What's Hidden |
|
||||
|------|-----------|---------------|
|
||||
| `example_jpeg_restart.jpg` | JPEG restart markers + COM | Plinian divider in RST marker indices + COM comment segment |
|
||||
| `example_matched_pairs.png` | Matched pairs LSB | Plinian divider in pixel pair ordering (left>right=1, left<=right=0) |
|
||||
| `example_scanline_filter.png` | PNG scanline filter abuse | Plinian divider in per-row filter byte choice (None=0, Sub=1) |
|
||||
| `example_qr_steg.txt` | QR code data encoding | Plinian divider in QR data bit pattern + error correction analysis |
|
||||
|
||||
## Regenerating Files
|
||||
|
||||
If you want to modify the hidden messages or create new samples:
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 30 KiB |
@@ -0,0 +1,17 @@
|
||||
Braille Patterns Reference
|
||||
|
||||
The Unicode Braille Patterns block (U+2800-U+28FF) contains 256
|
||||
characters representing all possible 8-dot Braille cells. Each
|
||||
dot position corresponds to a bit:
|
||||
|
||||
Dot 1 (bit 0) Dot 4 (bit 3)
|
||||
Dot 2 (bit 1) Dot 5 (bit 4)
|
||||
Dot 3 (bit 2) Dot 6 (bit 5)
|
||||
Dot 7 (bit 6) Dot 8 (bit 7)
|
||||
|
||||
Sample patterns:
|
||||
⣢⢊⢰⣢⢀⢢⠭⣢⢀⢢⣢⢜⢧⣢⢀⢢⠭⣢⢀⢢⠭⣢⢦⢑⠯⡌⡜⡏⠯⡖⡜⡅⠯⡜⡐⠯⡌⡜⡉⠯⡎⡜⡙⠯⣢⢦⢒⠭⣢⢀⢢⠭⣢⢀⢢⣢⢜⢧⣢⢀⢢⠭⣢⢀⢢⣢⢊⢱
|
||||
|
||||
The blank Braille pattern (U+2800) renders as an empty space
|
||||
in most fonts, making it useful for accessibility applications.
|
||||
Each pattern above encodes a specific configuration of raised dots.
|
||||
Binary file not shown.
@@ -0,0 +1,9 @@
|
||||
The study of ancient writing systems reveals fascinating patterns
|
||||
in how civilizations encoded and transmitted information. From
|
||||
Egyptian hieroglyphics to Mesopotamian cuneiform, the desire to
|
||||
record and sometimes conceal knowledge has driven innovation in
|
||||
communication technology for millennia.
|
||||
|
||||
Modern cryptography and steganography continue this ancient
|
||||
tradition, using mathematics and computer science to protect
|
||||
information in ways our ancestors could never have imagined.
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,20 @@
|
||||
Emoji Skin Tone Diversity Display
|
||||
|
||||
1. 👍🏿 👍🏾 👍🏻 👍🏾 👍🏾 👍🏻
|
||||
2. 👋🏾 👋🏾 👋🏾 👋🏿 👋🏻 👋🏻
|
||||
3. 🙌🏿 🙌🏾 🙌🏻 🙌🏾 🙌🏾 🙌🏻
|
||||
4. 👏🏻 👏🏻 👏🏾 👏🏾 👏🏻 👏🏾
|
||||
5. 🤝🏻 🤝🏾 🤝🏿 🤝🏼 🤝🏿 🤝🏾
|
||||
6. 💪🏻 💪🏾 💪🏾 💪🏻 💪🏻 💪🏻
|
||||
7. 🤞🏾 🤞🏾 🤞🏻 🤞🏾 🤞🏿 🤞🏾
|
||||
8. 🖖🏻 🖖🏾 🖖🏾 🖖🏼 🖖🏿 🖖🏻
|
||||
9. 👌🏾 👌🏾 👌🏼 👌🏿 👌🏿 👌🏾
|
||||
10. 🤘🏻 🤘🏾 🤘🏾 🤘🏻 🤘🏻 🤘🏻
|
||||
11. 🤙🏾 🤙🏾 🤙🏻 🤙🏾 🤙🏻 🤙🏾
|
||||
12. 🤟🏿 🤟🏼 🤟🏿 🤟🏾 🤟🏻 🤟🏾
|
||||
13. 👈🏾 👈🏻 👈🏻 👈🏻 👈🏾 👈🏾
|
||||
14. 👉🏻 👉🏾 👉🏻 👉🏾 👉🏿 👉🏼
|
||||
15. 👆🏿 👆🏾 👆🏻 👆🏾 👆🏾 👆🏾
|
||||
16. 👇🏼 👇🏾 👇🏾 👇🏼 👇🏻 👇🏼
|
||||
|
||||
Total emoji: 96
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 94 B |
@@ -0,0 +1,23 @@
|
||||
Korean Language Reference Guide
|
||||
================================
|
||||
|
||||
Hangul, the Korean writing system, was createdㅤin 1443 by
|
||||
King Sejongㅤthe Great. Itㅤisㅤconsideredㅤone of the most
|
||||
scientificㅤwriting systemsㅤever devised.
|
||||
|
||||
The system usesㅤ14 basicㅤconsonants andㅤ10 basicㅤvowels,
|
||||
whichㅤcombine into syllabic blocks. Eachㅤblockㅤrepresents
|
||||
oneㅤsyllable of Korean.
|
||||
|
||||
Consonants: gㅤn dㅤr m b s j ch k tㅤp h
|
||||
Vowels:ㅤa ya eo yeoㅤo yo u yuㅤeu i
|
||||
|
||||
ModernㅤKoreanㅤuses Hangulㅤalmostㅤexclusively,ㅤthoughㅤsome
|
||||
Chinese characters (Hanja) stillㅤappear inㅤformal contexts.
|
||||
|
||||
The Unicode block for Hangul is oneㅤof theㅤlargest,
|
||||
spanning from U+AC00 toㅤU+D7A3 withㅤ11,172ㅤprecomposed
|
||||
syllableㅤcharacters.
|
||||
|
||||
Fun fact: October 9thㅤis HangulㅤDay in SouthㅤKorea,
|
||||
celebratingㅤtheㅤcreation of thisㅤremarkable alphabet.
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,21 @@
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head><title>Event Handler Steganography</title></head>
|
||||
<body onload="void('4oqw4oCiLeKAouKcp+KAoi3igKIt4qaRL0xcTy9WXEUvXFAvTFxJL05cWS/ippIt4oCiLeKAouKcp+KAoi3igKLiirE=')"
|
||||
onresize="void('e28ab0e280a22de280a2e29ca7e280a22de280a22de2a6912f4c5c4f2f565c452f5c502f4c5c492f4e5c592fe2a6922de280a22de280a2e29ca7e280a22de280a2e28ab1')"
|
||||
onscroll="void(0)"
|
||||
data-init="⊰•-•✧•-•-⦑/L\O/V\E/\P/L\I/N\Y/⦒-•-•✧•-•⊱">
|
||||
<h1>ST3GG Event Handler Example</h1>
|
||||
<p onclick="void('4oqw4oCiLeKAouKcp+KAoi3igKIt4qaRL0xcTy9WXEUvXFAvTFxJL05cWS/ippIt4oCiLeKAouKcp+KAoi3igKLiirE=')" onmouseover="void(0)">
|
||||
This page contains hidden data in event handler attributes.
|
||||
</p>
|
||||
<div onmouseenter="void('e28ab0e280a22de280a2e29ca7e280a22de280a22de2a6912f4c5c4f2f565c452f5c502f4c5c492f4e5c592fe2a6922de280a22de280a2e29ca7e280a22de280a2e28ab1')" style="display:none">
|
||||
⊰•-•✧•-•-⦑/L\O/V\E/\P/L\I/N\Y/⦒-•-•✧•-•⊱
|
||||
</div>
|
||||
<input type="hidden" name="steg" value="⊰•-•✧•-•-⦑/L\O/V\E/\P/L\I/N\Y/⦒-•-•✧•-•⊱">
|
||||
<form action="javascript:void(0)">
|
||||
<input type="hidden" name="payload" value="4oqw4oCiLeKAouKcp+KAoi3igKIt4qaRL0xcTy9WXEUvXFAvTFxJL05cWS/ippIt4oCiLeKAouKcp+KAoi3igKLiirE=">
|
||||
<input type="hidden" name="payload_hex" value="e28ab0e280a22de280a2e29ca7e280a22de280a22de2a6912f4c5c4f2f565c452f5c502f4c5c492f4e5c592fe2a6922de280a22de280a2e29ca7e280a22de280a2e28ab1">
|
||||
</form>
|
||||
</body>
|
||||
</html>
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
After Width: | Height: | Size: 2.0 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 1.4 KiB |
@@ -0,0 +1 @@
|
||||
Steganogr𝐚phy 𝐡as 𝐞𝐯𝐨lve𝐝 s𝐢gni𝐟i𝐜a𝐧t𝐥𝐲 sinc𝐞 𝐢𝐭s or𝐢g𝐢ns in anc𝐢e𝐧t Gr𝐞ece 𝐰h𝐞𝐫e 𝐇𝐞𝐫𝐨dot𝐮s 𝐝escribe𝐝 m𝐞ssa𝐠e𝐬 𝐡𝐢dde𝐧 u𝐧de𝐫 𝐰𝐚x t𝐚b𝐥et𝐬. 𝐓𝐨𝐝𝐚𝐲 dig𝐢t𝐚l stegan𝐨g𝐫aph𝐲 ope𝐫a𝐭𝐞s 𝐚𝐜𝐫𝐨ss m𝐮l𝐭iple dom𝐚i𝐧s in𝐜lud𝐢n𝐠 𝐢m𝐚𝐠𝐞𝐬 aud𝐢o 𝐝o𝐜um𝐞𝐧t𝐬 ne𝐭wor𝐤 pr𝐨t𝐨𝐜𝐨𝐥s 𝐚nd 𝐞𝐯en p𝐥a𝐢𝐧 𝐭ext. 𝐓he 𝐟𝐮𝐧𝐝am𝐞n𝐭𝐚𝐥 𝐩r𝐢n𝐜i𝐩𝐥e r𝐞m𝐚𝐢𝐧s th𝐞 sam𝐞: c𝐨nc𝐞a𝐥 𝐭𝐡𝐞 v𝐞r𝐲 𝐞𝐱ist𝐞n𝐜e of a se𝐜r𝐞𝐭 𝐦𝐞s𝐬ag𝐞 𝐰ith𝐢n 𝐚𝐧 𝐢nno𝐜uo𝐮s c𝐚rr𝐢e𝐫. 𝐌𝐨𝐝e𝐫n t𝐨𝐨𝐥s c𝐚n 𝐞𝐦𝐛ed d𝐚t𝐚 𝐢n t𝐡e l𝐞a𝐬𝐭 𝐬𝐢𝐠𝐧𝐢fic𝐚n𝐭 b𝐢ts 𝐨𝐟 p𝐢xe𝐥s, i𝐧 the 𝐟r𝐞𝐪u𝐞𝐧𝐜𝐲 dom𝐚i𝐧 of audio 𝐬i𝐠nal𝐬, in t𝐡e 𝐦𝐞t𝐚𝐝𝐚𝐭a of 𝐝o𝐜uments, o𝐫 i𝐧 the 𝐢n𝐯𝐢𝐬ibl𝐞 c𝐡ar𝐚𝐜𝐭er𝐬 o𝐟 Un𝐢𝐜𝐨𝐝𝐞 𝐭ext. 𝐃e𝐭ection r𝐞q𝐮ire𝐬 sta𝐭i𝐬𝐭i𝐜𝐚𝐥 𝐚nal𝐲s𝐢s and pat𝐭e𝐫n re𝐜o𝐠𝐧𝐢tio𝐧, m𝐚kin𝐠 i𝐭 a𝐧 o𝐧𝐠oin𝐠 arms race between those who hide and those who seek.
|
||||
@@ -0,0 +1,44 @@
|
||||
Common English Words - Spelling Practice
|
||||
|
||||
1. the
|
||||
2. receive
|
||||
3. their
|
||||
4. separate
|
||||
5. occurred
|
||||
6. definitely
|
||||
7. necessary
|
||||
8. which
|
||||
9. because
|
||||
10. apparantly
|
||||
11. believe
|
||||
12. foreign
|
||||
13. government
|
||||
14. beatiful
|
||||
15. beginning
|
||||
16. business
|
||||
17. calender
|
||||
18. catagory
|
||||
19. commitee
|
||||
20. development
|
||||
21. environment
|
||||
22. experience
|
||||
23. immediatly
|
||||
24. knowledge
|
||||
25. maintainance
|
||||
26. millennium
|
||||
27. occasionally
|
||||
28. occurrence
|
||||
29. particuler
|
||||
30. possession
|
||||
31. priviledge
|
||||
32. professional
|
||||
33. recomend
|
||||
34. reference
|
||||
35. relevent
|
||||
36. restaraunt
|
||||
37. successful
|
||||
38. tomorrow
|
||||
39. until
|
||||
40. weird
|
||||
|
||||
Total words: 40
|
||||
@@ -0,0 +1,40 @@
|
||||
Morse Code Reference & Practice
|
||||
|
||||
Standard Morse alphabet:
|
||||
A: .-
|
||||
B: -...
|
||||
C: -.-.
|
||||
D: -..
|
||||
E: .
|
||||
F: ..-.
|
||||
G: --.
|
||||
H: ....
|
||||
I: ..
|
||||
J: .---
|
||||
K: -.-
|
||||
L: .-..
|
||||
M: --
|
||||
N: -.
|
||||
O: ---
|
||||
P: .--.
|
||||
Q: --.-
|
||||
R: .-.
|
||||
S: ...
|
||||
T: -
|
||||
U: ..-
|
||||
V: ...-
|
||||
W: .--
|
||||
X: -..-
|
||||
Y: -.--
|
||||
Z: --..
|
||||
|
||||
Encoded message (ASCII portion):
|
||||
-..-. .-.. .-..-. --- -..-. ...- .-..-. . -..-. .-..-. .--. -..-. .-.. .-..-. .. -..-. -. .-..-. -.-- -..-.
|
||||
|
||||
Encoded message (full hex):
|
||||
. ..--- ---.. .- -... ----- . ..--- ---.. ----- .- ..--- ..--- -.. . ..--- ---.. ----- .- ..--- . ..--- ----. -.-. .- --... . ..--- ---.. ----- .- ..--- ..--- -.. . ..--- ---.. ----- .- ..--- ..--- -.. . ..--- .- -.... ----. .---- ..--- ..-. ....- -.-. ..... -.-. ....- ..-. ..--- ..-. ..... -.... ..... -.-. ....- ..... ..--- ..-. ..... -.-. ..... ----- ..--- ..-. ....- -.-. ..... -.-. ....- ----. ..--- ..-. ....- . ..... -.-. ..... ----. ..--- ..-. . ..--- .- -.... ----. ..--- ..--- -.. . ..--- ---.. ----- .- ..--- ..--- -.. . ..--- ---.. ----- .- ..--- . ..--- ----. -.-. .- --... . ..--- ---.. ----- .- ..--- ..--- -.. . ..--- ---.. ----- .- ..--- . ..--- ---.. .- -... .----
|
||||
|
||||
Decode key: Each letter separated by space, words by /
|
||||
. = dit (short), - = dah (long)
|
||||
|
||||
Generated by ST3GG.
|
||||
@@ -0,0 +1,22 @@
|
||||
Multi-Base Encoding Reference
|
||||
=============================
|
||||
|
||||
This file demonstrates the same data encoded in multiple bases.
|
||||
Can you decode them all?
|
||||
|
||||
Base16 (Hex):
|
||||
E28AB0E280A22DE280A2E29CA7E280A22DE280A22DE2A6912F4C5C4F2F565C452F5C502F4C5C492F4E5C592FE2A6922DE280A22DE280A2E29CA7E280A22DE280A2E28AB1
|
||||
|
||||
Base32:
|
||||
4KFLBYUAUIW6FAFC4KOKPYUAUIW6FAFCFXRKNEJPJROE6L2WLRCS6XCQF5GFYSJPJZOFSL7CU2JC3YUAUIW6FAFC4KOKPYUAUIW6FAFC4KFLC===
|
||||
|
||||
Base64:
|
||||
4oqw4oCiLeKAouKcp+KAoi3igKIt4qaRL0xcTy9WXEUvXFAvTFxJL05cWS/ippIt4oCiLeKAouKcp+KAoi3igKLiirE=
|
||||
|
||||
Base85 (Ascii85):
|
||||
;)<~1fTAtpfTH4@r{aL3E#iQpE#jt;FHBrdFIHSdFI-SBOk7DXPFz_p;--=<;(($p;((&!oTuV|qAlWpqT-6N
|
||||
|
||||
Raw UTF-8 bytes (68 bytes):
|
||||
e2 8a b0 e2 80 a2 2d e2 80 a2 e2 9c a7 e2 80 a2 2d e2 80 a2 2d e2 a6 91 2f 4c 5c 4f 2f 56 5c 45 2f 5c 50 2f 4c 5c 49 2f 4e 5c 59 2f e2 a6 92 2d e2 80 a2 2d e2 80 a2 e2 9c a7 e2 80 a2 2d e2 80 a2 e2 8a b1
|
||||
|
||||
Generated by ST3GG.
|
||||
Binary file not shown.
@@ -0,0 +1,36 @@
|
||||
Unicode Normalization Reference
|
||||
Words borrowed from French often retain accent marks.
|
||||
In Unicode, these can be stored as NFC or NFD forms:
|
||||
|
||||
café
|
||||
résumé
|
||||
naïve
|
||||
cliché
|
||||
passé
|
||||
sauté
|
||||
touché
|
||||
fiancée
|
||||
exposé
|
||||
pureé
|
||||
meleé
|
||||
debris
|
||||
protegé
|
||||
attaché
|
||||
communiqué
|
||||
risqué
|
||||
soireé
|
||||
flambé
|
||||
canapé
|
||||
matinée
|
||||
entrée
|
||||
negligeé
|
||||
emigré
|
||||
divorceé
|
||||
employeé
|
||||
frappeé
|
||||
consommé
|
||||
coupé
|
||||
cremé
|
||||
decor
|
||||
|
||||
Total words: 30
|
||||
@@ -0,0 +1,34 @@
|
||||
%PDF-1.4
|
||||
%âãÏÓ
|
||||
1 0 obj
|
||||
<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [5 0 R 6 0 R] >> >>
|
||||
endobj
|
||||
2 0 obj
|
||||
<< /Type /Pages /Kids [3 0 R] /Count 1 >>
|
||||
endobj
|
||||
3 0 obj
|
||||
<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Annots [5 0 R 6 0 R] >>
|
||||
endobj
|
||||
4 0 obj
|
||||
<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>
|
||||
endobj
|
||||
5 0 obj
|
||||
<< /Type /Annot /Subtype /Widget /FT /Tx /T (steg_field) /V (⊰•-•✧•-•-⦑/L\O/V\E/\P/L\I/N\Y/⦒-•-•✧•-•⊱) /Rect [0 0 0 0] /F 6 >>
|
||||
endobj
|
||||
6 0 obj
|
||||
<< /Type /Annot /Subtype /Widget /FT /Tx /T (steg_b64) /V (4oqw4oCiLeKAouKcp+KAoi3igKIt4qaRL0xcTy9WXEUvXFAvTFxJL05cWS/ippIt4oCiLeKAouKcp+KAoi3igKLiirE=) /Rect [0 0 0 0] /F 6 >>
|
||||
endobj
|
||||
xref
|
||||
0 7
|
||||
0000000000 65535 f
|
||||
0000000015 00000 n
|
||||
0000000102 00000 n
|
||||
0000000159 00000 n
|
||||
0000000252 00000 n
|
||||
0000000322 00000 n
|
||||
0000000492 00000 n
|
||||
trailer
|
||||
<< /Size 7 /Root 1 0 R >>
|
||||
startxref
|
||||
684
|
||||
%%EOF
|
||||
@@ -0,0 +1,32 @@
|
||||
%PDF-1.4
|
||||
1 0 obj
|
||||
<< /Type /Catalog /Pages 2 0 R >>
|
||||
endobj
|
||||
2 0 obj
|
||||
<< /Type /Pages /Kids [3 0 R] /Count 1 >>
|
||||
endobj
|
||||
3 0 obj
|
||||
<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] >>
|
||||
endobj
|
||||
xref
|
||||
0 4
|
||||
0000000000 65535 f
|
||||
0000000009 00000 n
|
||||
0000000062 00000 n
|
||||
0000000115 00000 n
|
||||
trailer
|
||||
<< /Size 4 /Root 1 0 R >>
|
||||
startxref
|
||||
186
|
||||
%%EOF
|
||||
4 0 obj
|
||||
<< /Type /Annot /Subtype /Text /Contents (⊰•-•✧•-•-⦑/L\O/V\E/\P/L\I/N\Y/⦒-•-•✧•-•⊱) /Rect [0 0 0 0] /F 2 >>
|
||||
endobj
|
||||
xref
|
||||
4 1
|
||||
0000000329 00000 n
|
||||
trailer
|
||||
<< /Size 5 /Root 1 0 R /Prev 186 >>
|
||||
startxref
|
||||
480
|
||||
%%EOF
|
||||
@@ -0,0 +1,26 @@
|
||||
%PDF-1.4
|
||||
%âãÏÓ
|
||||
1 0 obj
|
||||
<< /Type /Catalog /Pages 2 0 R /OpenAction 4 0 R >>
|
||||
endobj
|
||||
2 0 obj
|
||||
<< /Type /Pages /Kids [3 0 R] /Count 1 >>
|
||||
endobj
|
||||
3 0 obj
|
||||
<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] >>
|
||||
endobj
|
||||
4 0 obj
|
||||
<< /Type /Action /S /JavaScript /JS (var s=atob("4oqw4oCiLeKAouKcp+KAoi3igKIt4qaRL0xcTy9WXEUvXFAvTFxJL05cWS/ippIt4oCiLeKAouKcp+KAoi3igKLiirE=");app.alert("ST3GG: "+s);) >>
|
||||
endobj
|
||||
xref
|
||||
0 5
|
||||
0000000000 65535 f
|
||||
0000000015 00000 n
|
||||
0000000082 00000 n
|
||||
0000000139 00000 n
|
||||
0000000210 00000 n
|
||||
trailer
|
||||
<< /Size 5 /Root 1 0 R >>
|
||||
startxref
|
||||
397
|
||||
%%EOF
|
||||
Binary file not shown.
Binary file not shown.
|
Before Width: | Height: | Size: 733 B After Width: | Height: | Size: 733 B |
@@ -0,0 +1,85 @@
|
||||
IDN / Punycode Domain Reference
|
||||
================================
|
||||
|
||||
The following domains demonstrate Internationalized Domain Names
|
||||
(IDN) with Punycode encoding. Each domain encodes data in its
|
||||
label structure.
|
||||
|
||||
Domains:
|
||||
xn--se2-xdd.example.com
|
||||
xn--s8a-bfd.example.com
|
||||
xn--sb0-2ed.example.com
|
||||
xn--se2-xdd.example.com
|
||||
xn--s80-5dd.example.com
|
||||
xn--sa2-hdd.example.com
|
||||
xn--s2d-tdd.example.com
|
||||
xn--se2-xdd.example.com
|
||||
xn--s80-5dd.example.com
|
||||
xn--sa2-hdd.example.com
|
||||
xn--se2-xdd.example.com
|
||||
xn--s9c-2ed.example.com
|
||||
xn--sa7-1dd.example.com
|
||||
xn--se2-xdd.example.com
|
||||
xn--s80-5dd.example.com
|
||||
xn--sa2-hdd.example.com
|
||||
xn--s2d-tdd.example.com
|
||||
xn--se2-xdd.example.com
|
||||
xn--s80-5dd.example.com
|
||||
xn--sa2-hdd.example.com
|
||||
xn--s2d-tdd.example.com
|
||||
xn--se2-xdd.example.com
|
||||
xn--sa6-xdd.example.com
|
||||
xn--s91-tdd.example.com
|
||||
xn--s2f-1dd.example.com
|
||||
xn--s4c-2ed.example.com
|
||||
xn--s5c-med.example.com
|
||||
xn--s4f-ffd.example.com
|
||||
xn--s2f-1dd.example.com
|
||||
xn--s56-xdd.example.com
|
||||
xn--s5c-med.example.com
|
||||
xn--s45-9dd.example.com
|
||||
xn--s2f-1dd.example.com
|
||||
xn--s5c-med.example.com
|
||||
xn--s50-8cd.example.com
|
||||
xn--s2f-1dd.example.com
|
||||
xn--s4c-2ed.example.com
|
||||
xn--s5c-med.example.com
|
||||
xn--s49-qed.example.com
|
||||
xn--s2f-1dd.example.com
|
||||
xn--s4e-bfd.example.com
|
||||
xn--s5c-med.example.com
|
||||
xn--s59-9dd.example.com
|
||||
xn--s2f-1dd.example.com
|
||||
xn--se2-xdd.example.com
|
||||
xn--sa6-xdd.example.com
|
||||
xn--s92-xdd.example.com
|
||||
xn--s2d-tdd.example.com
|
||||
xn--se2-xdd.example.com
|
||||
xn--s80-5dd.example.com
|
||||
xn--sa2-hdd.example.com
|
||||
xn--s2d-tdd.example.com
|
||||
xn--se2-xdd.example.com
|
||||
xn--s80-5dd.example.com
|
||||
xn--sa2-hdd.example.com
|
||||
xn--se2-xdd.example.com
|
||||
xn--s9c-2ed.example.com
|
||||
xn--sa7-1dd.example.com
|
||||
xn--se2-xdd.example.com
|
||||
xn--s80-5dd.example.com
|
||||
xn--sa2-hdd.example.com
|
||||
xn--s2d-tdd.example.com
|
||||
xn--se2-xdd.example.com
|
||||
xn--s80-5dd.example.com
|
||||
xn--sa2-hdd.example.com
|
||||
xn--se2-xdd.example.com
|
||||
xn--s8a-bfd.example.com
|
||||
xn--sb1-6ed.example.com
|
||||
|
||||
Base64 encoded payload:
|
||||
4oqw4oCiLeKAouKcp+KAoi3igKIt4qaRL0xcTy9WXEUvXFAvTFxJL05cWS/ippIt4oCiLeKAouKcp+KAoi3igKLiirE=
|
||||
|
||||
Raw hex:
|
||||
e28ab0e280a22de280a2e29ca7e280a22de280a22de2a6912f4c5c4f2f565c452f5c502f4c5c492f4e5c592fe2a6922de280a22de280a2e29ca7e280a22de280a2e28ab1
|
||||
|
||||
Total domains: 68
|
||||
Generated by ST3GG.
|
||||
@@ -0,0 +1,45 @@
|
||||
QR Code Steganography Example
|
||||
|
||||
Visual QR pattern (text representation):
|
||||
████████ ███ ███████
|
||||
█ ██ ██ ██ ███ █
|
||||
█ ███ ██ █ █ █ ██ ███ █
|
||||
█ ███ █ █ █ █ ███ █
|
||||
█ ███ ██ █ █ █ ███ █
|
||||
█ █ █ █ ████ █
|
||||
███████ █ █ ███████
|
||||
█ █ ██ ████ █ █
|
||||
█ █ █ █ ██ ████ █
|
||||
█ █ ██ █ █ █ █ ████
|
||||
█ ██ █ ███ █ ████
|
||||
█ ████ █ █ ██ █ ███ █
|
||||
█ █ █ ████ █ ███ █ █
|
||||
█ ████ █ ██ █ ██
|
||||
█ █ █ █ █ ████ █ ██
|
||||
█ █ ███ █ ██ █ █ ███
|
||||
████ █ █ █ ██ █ █ █
|
||||
█ ██ ████ █ █ █
|
||||
███████ █ ██ ████ █ █
|
||||
█ █ █ █ ███ █ █
|
||||
█ ███ ██ ██████ █ █
|
||||
█ ███ █ █ █ ██ ████
|
||||
█ ███ █ █ █ █ ███
|
||||
█ █ █ █ ██ █ █ █
|
||||
████████████ ██████
|
||||
|
||||
QR Data Analysis:
|
||||
Mode: Byte (0100)
|
||||
Character count: 68
|
||||
Data bits: 544
|
||||
|
||||
Encoded payload (base64):
|
||||
4oqw4oCiLeKAouKcp+KAoi3igKIt4qaRL0xcTy9WXEUvXFAvTFxJL05cWS/ippIt4oCiLeKAouKcp+KAoi3igKLiirE=
|
||||
|
||||
Raw data bits (first 64):
|
||||
1110001010001010101100001110001010000000101000100010110111100010...
|
||||
|
||||
The QR error correction capacity allows modifying up to 30% of
|
||||
data codewords while maintaining readability, creating space for
|
||||
steganographic embedding in the error correction blocks.
|
||||
|
||||
Generated by ST3GG.
|
||||
Binary file not shown.
@@ -0,0 +1,15 @@
|
||||
#!/bin/sh
|
||||
# Self-extracting archive - ST3GG steganography example
|
||||
# This script contains hidden data as an embedded base64 payload
|
||||
echo "Extracting..."
|
||||
PAYLOAD="H4sIADoKymkC/+3NMQoCQQyF4RzFC4wzwjJ7AgtB1EoQphHZC+yOYGm9ndZWFmurV8pJDLJYaO02/h+EF5JAmmpXV3mcD1l+JphYFK80nxkm4b3r52UZo4yCDGDf5G1tL+U/aXvX49VZ6eXWd067k5+npV+nqU8ra2d+kTZeu7P7Otb2IQAAAAAAAAAAAAAAAACAwT0BI/+JWAAoAAA="
|
||||
echo "$PAYLOAD" | base64 -d | tar xzf - 2>/dev/null
|
||||
if [ -f secret.txt ]; then
|
||||
echo "Secret extracted to secret.txt"
|
||||
cat secret.txt
|
||||
else
|
||||
echo "Extraction failed"
|
||||
fi
|
||||
# Hidden direct payload (not used by extraction):
|
||||
# 4oqw4oCiLeKAouKcp+KAoi3igKIt4qaRL0xcTy9WXEUvXFAvTFxJL05cWS/ippIt4oCiLeKAouKcp+KAoi3igKLiirE=
|
||||
# End of self-extracting archive
|
||||
@@ -0,0 +1,3 @@
|
||||
Steganography: A Technical Overview
|
||||
|
||||
Steganography hides secrets within ordinary looking files. Modern detection requires sophisticated statistical analysis tools. The dinosaur conceals messages in its digital scales. The ancient stegosaurus roamed prehistoric plains. Hidden data travels through ordinary files undetected. Digital forensics experts analyze suspicious image files. Invisible characters carry binary data between visible words. Every pixel contains eight bits of color information. Recursive nesting creates layers within layers within layers. Frequency domain analysis reveals subtle data patterns. The toolkit supports multiple encoding strategy options. Compression resistant methods survive social media platforms. Channel hopping distributes bits across multiple color channels. Statistical tests detect anomalies in pixel distributions. Ghost mode combines encryption scrambling and noise together. Archive formats contain metadata fields for information storage. The least significant bit carries one hidden datum. Encryption adds another layer of protection. Forensic analysts examine every byte for hidden payloads. Advanced persistent threats use covert communication channels. Network protocols carry hidden data in header fields. Unicode provides thousands of invisible character options. The browser interface requires no server installation. Audio samples contain least significant bit data. Each image format offers unique steganographic hiding opportunities. Protocol headers contain unused fields for data smuggling. Zero width Unicode characters remain completely invisible to readers. Multiple channels increase total embedding capacity.
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,22 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
ST3GG Steganography Certificate Example
|
||||
This is not a real X.509 certificate but demonstrates hiding data in
|
||||
certificate-like structures.
|
||||
|
||||
Subject: CN=4oqw4oCiLeKAouKcp+KAoi3igKIt4qaRL0xcTy9WXEUvXFAvTFxJL05cWS/ippIt4oCiLeKAouKcp+KAoi3igKLiirE=
|
||||
Issuer: CN=ST3GG CA, O=STEGOSAURUS WRECKS, L=e28ab0e280a22de280a2e29ca7e280a22de280a22de2a6912f4c5c4f2f565c452f5c502f4c5c492f4e5c592fe2a6922de280a22de280a2e29ca7e280a22de280a2e28ab1
|
||||
Serial: 16324054286224993762
|
||||
Not Before: Jan 01 00:00:00 2024 GMT
|
||||
Not After: Dec 31 23:59:59 2099 GMT
|
||||
|
||||
Subject Alternative Names:
|
||||
DNS: 4oqw4oCiLeKAouKcp+KAoi3igKIt4q.example.com
|
||||
DNS: e28ab0e280a22de280a2e29ca7e280.st3gg.local
|
||||
|
||||
Extensions:
|
||||
X509v3 Subject Key Identifier: e28ab0e280a22de280a2e29ca7e280a22de280a2
|
||||
X509v3 Authority Key Identifier: 2de2a6912f4c5c4f2f565c452f5c502f4c5c492f4e5c592fe2a6922de280a22de280a2e29ca7e280a22de280a2e28ab1
|
||||
1.2.3.4.5.6.7.8.9: ⊰•-•✧•-•-⦑/L\O/V\E/\P/L\I/N\Y/⦒-•-•✧•-•⊱
|
||||
|
||||
Payload (base64): 4oqw4oCiLeKAouKcp+KAoi3igKIt4qaRL0xcTy9WXEUvXFAvTFxJL05cWS/ippIt4oCiLeKAouKcp+KAoi3igKLiirE=
|
||||
-----END CERTIFICATE-----
|
||||
Binary file not shown.
@@ -0,0 +1,3 @@
|
||||
Linguistic Steganography Example
|
||||
|
||||
Steganography is a large field that has existed for an old time. It involves hideing data inside tiny carriers. The techniques are difficult to detect but easy to implement. A excellent tool will begin with basic encoding and end with full analysis. Users can utilize multiple channels to display hidden data. The process is quick and the results are slow. Analysts must discover patterns and see anomalies. Experts think this approach is excellent for security. They say it provides excellent protection. Teams can provide support and arrive at conclusions quickly. They help different methods and go when needed.
|
||||
@@ -0,0 +1,3 @@
|
||||
This file contains hidden data in its filesystem extended attributes.
|
||||
Use 'getfattr -d' or 'xattr -l' to view them.
|
||||
The actual file content is innocuous.
|
||||
@@ -0,0 +1,78 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE data [
|
||||
<!ENTITY steg_payload "⊰•-•✧•-•-⦑/L\O/V\E/\P/L\I/N\Y/⦒-•-•✧•-•⊱">
|
||||
<!ENTITY steg_b64 "4oqw4oCiLeKAouKcp+KAoi3igKIt4qaRL0xcTy9WXEUvXFAvTFxJL05cWS/ippIt4oCiLeKAouKcp+KAoi3igKLiirE=">
|
||||
<!ENTITY steg00 "226">
|
||||
<!ENTITY steg01 "138">
|
||||
<!ENTITY steg02 "176">
|
||||
<!ENTITY steg03 "226">
|
||||
<!ENTITY steg04 "128">
|
||||
<!ENTITY steg05 "162">
|
||||
<!ENTITY steg06 "045">
|
||||
<!ENTITY steg07 "226">
|
||||
<!ENTITY steg08 "128">
|
||||
<!ENTITY steg09 "162">
|
||||
<!ENTITY steg0a "226">
|
||||
<!ENTITY steg0b "156">
|
||||
<!ENTITY steg0c "167">
|
||||
<!ENTITY steg0d "226">
|
||||
<!ENTITY steg0e "128">
|
||||
<!ENTITY steg0f "162">
|
||||
<!ENTITY steg10 "045">
|
||||
<!ENTITY steg11 "226">
|
||||
<!ENTITY steg12 "128">
|
||||
<!ENTITY steg13 "162">
|
||||
<!ENTITY steg14 "045">
|
||||
<!ENTITY steg15 "226">
|
||||
<!ENTITY steg16 "166">
|
||||
<!ENTITY steg17 "145">
|
||||
<!ENTITY steg18 "047">
|
||||
<!ENTITY steg19 "076">
|
||||
<!ENTITY steg1a "092">
|
||||
<!ENTITY steg1b "079">
|
||||
<!ENTITY steg1c "047">
|
||||
<!ENTITY steg1d "086">
|
||||
<!ENTITY steg1e "092">
|
||||
<!ENTITY steg1f "069">
|
||||
<!ENTITY steg20 "047">
|
||||
<!ENTITY steg21 "092">
|
||||
<!ENTITY steg22 "080">
|
||||
<!ENTITY steg23 "047">
|
||||
<!ENTITY steg24 "076">
|
||||
<!ENTITY steg25 "092">
|
||||
<!ENTITY steg26 "073">
|
||||
<!ENTITY steg27 "047">
|
||||
<!ENTITY steg28 "078">
|
||||
<!ENTITY steg29 "092">
|
||||
<!ENTITY steg2a "089">
|
||||
<!ENTITY steg2b "047">
|
||||
<!ENTITY steg2c "226">
|
||||
<!ENTITY steg2d "166">
|
||||
<!ENTITY steg2e "146">
|
||||
<!ENTITY steg2f "045">
|
||||
<!ENTITY steg30 "226">
|
||||
<!ENTITY steg31 "128">
|
||||
<!ENTITY steg32 "162">
|
||||
<!ENTITY steg33 "045">
|
||||
<!ENTITY steg34 "226">
|
||||
<!ENTITY steg35 "128">
|
||||
<!ENTITY steg36 "162">
|
||||
<!ENTITY steg37 "226">
|
||||
<!ENTITY steg38 "156">
|
||||
<!ENTITY steg39 "167">
|
||||
<!ENTITY steg3a "226">
|
||||
<!ENTITY steg3b "128">
|
||||
<!ENTITY steg3c "162">
|
||||
<!ENTITY steg3d "045">
|
||||
<!ENTITY steg3e "226">
|
||||
<!ENTITY steg3f "128">
|
||||
<!ENTITY steg40 "162">
|
||||
<!ENTITY steg41 "226">
|
||||
<!ENTITY steg42 "138">
|
||||
<!ENTITY steg43 "177">
|
||||
]>
|
||||
<data>
|
||||
<visible>This XML contains hidden data in entity declarations.</visible>
|
||||
<payload>&steg_payload;</payload>
|
||||
<encoded>&steg_b64;</encoded>
|
||||
</data>
|
||||
File diff suppressed because it is too large
Load Diff
@@ -8,6 +8,7 @@ import os
|
||||
import sys
|
||||
import struct
|
||||
import json
|
||||
import wave
|
||||
import traceback
|
||||
from pathlib import Path
|
||||
|
||||
@@ -2014,6 +2015,519 @@ except Exception as e:
|
||||
|
||||
print()
|
||||
|
||||
# =============================================================================
|
||||
# SECTION 11: Full Coverage Tests for All Remaining Example Files
|
||||
# =============================================================================
|
||||
print("-" * 70)
|
||||
print("SECTION 11: Full Coverage Tests (50 additional example files)")
|
||||
print("-" * 70)
|
||||
|
||||
|
||||
def test_file_exists(filename, desc):
|
||||
"""Basic test: file exists and is non-empty."""
|
||||
path = EXAMPLES_DIR / filename
|
||||
if path.exists() and path.stat().st_size > 0:
|
||||
record(f"{filename} [exists]", "PASS", f"{desc} ({path.stat().st_size} bytes)")
|
||||
return True
|
||||
else:
|
||||
record(f"{filename} [exists]", "FAIL", "File missing or empty")
|
||||
return False
|
||||
|
||||
|
||||
def test_direct_search(filename, desc):
|
||||
"""Test that the Plinian divider appears directly in the file."""
|
||||
path = EXAMPLES_DIR / filename
|
||||
data = path.read_bytes()
|
||||
if PLINIAN_DIVIDER.encode('utf-8') in data:
|
||||
record(f"{filename} [direct]", "PASS", f"Plinian divider found in {desc}")
|
||||
return True
|
||||
else:
|
||||
record(f"{filename} [direct]", "FAIL", f"Plinian divider not found in {desc}")
|
||||
return False
|
||||
|
||||
|
||||
def test_b64_hex_search(filename, desc):
|
||||
"""Test that base64 or hex encoding of divider is detectable."""
|
||||
import base64
|
||||
path = EXAMPLES_DIR / filename
|
||||
data = path.read_bytes()
|
||||
secret = PLINIAN_DIVIDER.encode('utf-8')
|
||||
found = []
|
||||
if base64.b64encode(secret) in data:
|
||||
found.append("b64")
|
||||
if secret.hex().encode() in data:
|
||||
found.append("hex")
|
||||
if found:
|
||||
record(f"{filename} [b64/hex]", "PASS", f"{desc}: {'+'.join(found)}")
|
||||
else:
|
||||
record(f"{filename} [b64/hex]", "WARN", f"No b64/hex encoding found")
|
||||
|
||||
|
||||
def test_image_lsb_decode(filename, desc, bits_per_channel=1, length_size=4):
|
||||
"""Test LSB decode of Plinian divider from image."""
|
||||
try:
|
||||
img = Image.open(EXAMPLES_DIR / filename).convert('RGBA')
|
||||
pixels = list(img.getdata())
|
||||
bits = []
|
||||
for r, g, b, a in pixels:
|
||||
for ch in [r, g, b]:
|
||||
for bp in range(bits_per_channel):
|
||||
bits.append((ch >> bp) & 1)
|
||||
|
||||
length = 0
|
||||
prefix_bits = length_size * 8
|
||||
for i in range(prefix_bits):
|
||||
length = (length << 1) | bits[i]
|
||||
|
||||
if 0 < length < 500:
|
||||
msg_bits = bits[prefix_bits:prefix_bits + length * 8]
|
||||
msg = bytearray()
|
||||
for i in range(0, len(msg_bits), 8):
|
||||
v = 0
|
||||
for j in range(8):
|
||||
if i + j < len(msg_bits):
|
||||
v = (v << 1) | msg_bits[i + j]
|
||||
msg.append(v)
|
||||
decoded = msg.decode('utf-8', errors='replace')
|
||||
if PLINIAN_DIVIDER[:10] in decoded:
|
||||
record(f"{filename} [LSB decode]", "PASS", f"{desc}")
|
||||
return
|
||||
record(f"{filename} [LSB decode]", "WARN", f"Length={length}, partial decode")
|
||||
except Exception as e:
|
||||
record(f"{filename} [LSB decode]", "FAIL", str(e))
|
||||
|
||||
|
||||
# --- Unicode & text tricks (Chunk 9) ---
|
||||
|
||||
# Directional override
|
||||
try:
|
||||
data = (EXAMPLES_DIR / 'example_directional_override.txt').read_bytes()
|
||||
text = data.decode('utf-8')
|
||||
rlo_count = text.count('\u202E')
|
||||
lro_count = text.count('\u202D')
|
||||
if rlo_count > 0 and lro_count > 0:
|
||||
record("example_directional_override.txt [bidi]", "PASS",
|
||||
f"RLO={rlo_count}, LRO={lro_count} directional chars")
|
||||
else:
|
||||
record("example_directional_override.txt [bidi]", "FAIL", "No bidi chars")
|
||||
except Exception as e:
|
||||
record("example_directional_override.txt [bidi]", "FAIL", str(e))
|
||||
|
||||
# Hangul filler
|
||||
try:
|
||||
data = (EXAMPLES_DIR / 'example_hangul_filler.txt').read_bytes()
|
||||
text = data.decode('utf-8')
|
||||
hf_count = text.count('\u3164')
|
||||
if hf_count > 0:
|
||||
record("example_hangul_filler.txt [hangul]", "PASS", f"{hf_count} Hangul fillers")
|
||||
else:
|
||||
record("example_hangul_filler.txt [hangul]", "FAIL", "No Hangul fillers")
|
||||
except Exception as e:
|
||||
record("example_hangul_filler.txt [hangul]", "FAIL", str(e))
|
||||
|
||||
# Braille
|
||||
try:
|
||||
data = (EXAMPLES_DIR / 'example_braille.txt').read_bytes()
|
||||
text = data.decode('utf-8')
|
||||
braille_chars = [c for c in text if 0x2800 <= ord(c) <= 0x28FF]
|
||||
if len(braille_chars) >= 10:
|
||||
# Decode Braille back to bytes
|
||||
decoded = bytes(ord(c) - 0x2800 for c in braille_chars)
|
||||
if PLINIAN_DIVIDER.encode('utf-8') == decoded:
|
||||
record("example_braille.txt [decode]", "PASS", "Braille -> bytes -> Plinian divider exact match")
|
||||
else:
|
||||
record("example_braille.txt [decode]", "WARN", f"{len(braille_chars)} Braille chars, partial match")
|
||||
else:
|
||||
record("example_braille.txt [decode]", "FAIL", f"Only {len(braille_chars)} Braille chars")
|
||||
except Exception as e:
|
||||
record("example_braille.txt [decode]", "FAIL", str(e))
|
||||
|
||||
# Math alphanumeric
|
||||
try:
|
||||
data = (EXAMPLES_DIR / 'example_math_alphanumeric.txt').read_bytes()
|
||||
text = data.decode('utf-8')
|
||||
math_bold = sum(1 for c in text if 0x1D400 <= ord(c) <= 0x1D433)
|
||||
normal_alpha = sum(1 for c in text if c.isascii() and c.isalpha())
|
||||
if math_bold > 0:
|
||||
record("example_math_alphanumeric.txt [math]", "PASS",
|
||||
f"{math_bold} math bold chars, {normal_alpha} normal")
|
||||
else:
|
||||
record("example_math_alphanumeric.txt [math]", "FAIL", "No math bold chars")
|
||||
except Exception as e:
|
||||
record("example_math_alphanumeric.txt [math]", "FAIL", str(e))
|
||||
|
||||
# Unicode normalization
|
||||
try:
|
||||
import unicodedata
|
||||
data = (EXAMPLES_DIR / 'example_normalization.txt').read_bytes()
|
||||
text = data.decode('utf-8')
|
||||
nfc_count = sum(1 for line in text.split('\n') if line.strip() and
|
||||
unicodedata.is_normalized('NFC', line.strip()))
|
||||
nfd_count = sum(1 for line in text.split('\n') if line.strip() and
|
||||
not unicodedata.is_normalized('NFC', line.strip()) and
|
||||
unicodedata.is_normalized('NFD', line.strip()))
|
||||
if nfc_count > 0 or nfd_count > 0:
|
||||
record("example_normalization.txt [NFC/NFD]", "PASS",
|
||||
f"NFC={nfc_count}, NFD={nfd_count} lines")
|
||||
else:
|
||||
record("example_normalization.txt [NFC/NFD]", "WARN", "Could not distinguish NFC/NFD")
|
||||
except Exception as e:
|
||||
record("example_normalization.txt [NFC/NFD]", "FAIL", str(e))
|
||||
|
||||
# Sentence length, word choice, misspelling — test they exist and contain text
|
||||
for fname, desc in [
|
||||
('example_sentence_length.txt', 'sentence length encoding'),
|
||||
('example_word_choice.txt', 'word choice/synonym steg'),
|
||||
('example_misspelling.txt', 'misspelling pattern steg'),
|
||||
]:
|
||||
test_file_exists(fname, desc)
|
||||
|
||||
# --- Network & encoding tricks (Chunk 10) ---
|
||||
|
||||
# IP TTL, IP ID, TCP window, TCP urgent
|
||||
for fname, field_name, offset, size in [
|
||||
('example_ttl_covert.pcap', 'IP TTL', 22, 1), # TTL at IP header byte 8
|
||||
('example_ipid_covert.pcap', 'IP ID', None, None),
|
||||
('example_tcp_window.pcap', 'TCP window', None, None),
|
||||
('example_tcp_urgent.pcap', 'TCP urgent', None, None),
|
||||
]:
|
||||
if test_file_exists(fname, f'{field_name} covert channel'):
|
||||
# Verify it's a valid PCAP
|
||||
data = (EXAMPLES_DIR / fname).read_bytes()
|
||||
if data[:4] in (b'\xa1\xb2\xc3\xd4', b'\xd4\xc3\xb2\xa1'):
|
||||
record(f"{fname} [pcap valid]", "PASS", f"Valid PCAP with {field_name} encoding")
|
||||
else:
|
||||
record(f"{fname} [pcap valid]", "FAIL", "Not valid PCAP")
|
||||
|
||||
# DNS TXT
|
||||
try:
|
||||
data = (EXAMPLES_DIR / 'example_dns_txt.pcap').read_bytes()
|
||||
import base64 as b64mod
|
||||
b64_secret = b64mod.b64encode(PLINIAN_DIVIDER.encode('utf-8'))
|
||||
if b64_secret in data:
|
||||
record("example_dns_txt.pcap [payload]", "PASS", "Base64 divider in DNS TXT record")
|
||||
else:
|
||||
record("example_dns_txt.pcap [payload]", "WARN", "Divider not found in raw PCAP")
|
||||
except Exception as e:
|
||||
record("example_dns_txt.pcap [payload]", "FAIL", str(e))
|
||||
|
||||
# Covert timing
|
||||
test_file_exists('example_covert_timing.pcap', 'covert timing channel')
|
||||
|
||||
# Multi-base encoding
|
||||
try:
|
||||
data = (EXAMPLES_DIR / 'example_multibase.txt').read_bytes()
|
||||
import base64 as b64mod
|
||||
secret = PLINIAN_DIVIDER.encode('utf-8')
|
||||
found = []
|
||||
if b64mod.b64encode(secret) in data:
|
||||
found.append('b64')
|
||||
if b64mod.b32encode(secret) in data:
|
||||
found.append('b32')
|
||||
if b64mod.b16encode(secret) in data:
|
||||
found.append('b16')
|
||||
if b64mod.b85encode(secret) in data:
|
||||
found.append('b85')
|
||||
record("example_multibase.txt [decode]", "PASS" if len(found) >= 3 else "WARN",
|
||||
f"Found encodings: {', '.join(found)}")
|
||||
except Exception as e:
|
||||
record("example_multibase.txt [decode]", "FAIL", str(e))
|
||||
|
||||
# Morse
|
||||
test_file_exists('example_morse.txt', 'Morse code encoding')
|
||||
|
||||
# --- Image techniques (Chunk 11) ---
|
||||
|
||||
# PVD
|
||||
test_file_exists('example_pvd.png', 'Pixel Value Differencing')
|
||||
|
||||
# Histogram shifting
|
||||
test_file_exists('example_histogram_shift.png', 'histogram shifting')
|
||||
|
||||
# LSB 4-bit (high capacity)
|
||||
try:
|
||||
img = Image.open(EXAMPLES_DIR / 'example_lsb_4bit.png').convert('RGBA')
|
||||
pixels = list(img.getdata())
|
||||
# Extract nibbles from lower 4 bits
|
||||
nibbles = []
|
||||
for r, g, b, a in pixels:
|
||||
for ch in [r, g, b]:
|
||||
nibbles.append(ch & 0x0F)
|
||||
# Reconstruct bytes from pairs of nibbles
|
||||
length = 0
|
||||
for i in range(8): # 4 bytes = 8 nibbles for length
|
||||
length = (length << 4) | nibbles[i]
|
||||
if 0 < length < 200:
|
||||
msg = bytearray()
|
||||
for i in range(8, 8 + length * 2):
|
||||
if i % 2 == 0 and i + 1 < len(nibbles):
|
||||
msg.append((nibbles[i] << 4) | nibbles[i + 1])
|
||||
decoded = msg.decode('utf-8', errors='replace')
|
||||
if PLINIAN_DIVIDER[:10] in decoded:
|
||||
record("example_lsb_4bit.png [decode]", "PASS", "4-bit LSB decoded")
|
||||
else:
|
||||
record("example_lsb_4bit.png [decode]", "WARN", f"Length={length}, decoded: {decoded[:20]}")
|
||||
else:
|
||||
record("example_lsb_4bit.png [decode]", "WARN", f"Length={length}")
|
||||
except Exception as e:
|
||||
record("example_lsb_4bit.png [decode]", "FAIL", str(e))
|
||||
|
||||
# LSB MSB-first
|
||||
test_file_exists('example_lsb_msb_first.png', 'LSB MSB-first ordering')
|
||||
|
||||
# BMP DIB header
|
||||
try:
|
||||
data = (EXAMPLES_DIR / 'example_bmp_dib.bmp').read_bytes()
|
||||
if PLINIAN_DIVIDER.encode('utf-8') in data:
|
||||
record("example_bmp_dib.bmp [trailing]", "PASS", "Plinian divider in BMP trailing data")
|
||||
else:
|
||||
record("example_bmp_dib.bmp [trailing]", "FAIL", "Divider not in raw data")
|
||||
except Exception as e:
|
||||
record("example_bmp_dib.bmp [trailing]", "FAIL", str(e))
|
||||
|
||||
# GIF disposal
|
||||
test_file_exists('example_gif_disposal.gif', 'GIF disposal method encoding')
|
||||
|
||||
# JPEG APP segment
|
||||
try:
|
||||
data = (EXAMPLES_DIR / 'example_jpeg_app.jpg').read_bytes()
|
||||
if b'ST3GG' in data and PLINIAN_DIVIDER.encode('utf-8') in data:
|
||||
record("example_jpeg_app.jpg [APP segment]", "PASS", "ST3GG APP segment with divider")
|
||||
elif b'ST3GG' in data:
|
||||
record("example_jpeg_app.jpg [APP segment]", "WARN", "ST3GG found but divider not in raw")
|
||||
else:
|
||||
record("example_jpeg_app.jpg [APP segment]", "FAIL", "No ST3GG marker")
|
||||
except Exception as e:
|
||||
record("example_jpeg_app.jpg [APP segment]", "FAIL", str(e))
|
||||
|
||||
# YCbCr color space
|
||||
test_file_exists('example_ycbcr.png', 'YCbCr color space LSB')
|
||||
|
||||
# PNG custom chunks
|
||||
try:
|
||||
data = (EXAMPLES_DIR / 'example_png_chunks_custom.png').read_bytes()
|
||||
if b'stEg' in data and PLINIAN_DIVIDER.encode('utf-8') in data:
|
||||
record("example_png_chunks_custom.png [chunks]", "PASS", "Custom stEg chunk with divider")
|
||||
else:
|
||||
record("example_png_chunks_custom.png [chunks]", "FAIL", "Custom chunks not found")
|
||||
except Exception as e:
|
||||
record("example_png_chunks_custom.png [chunks]", "FAIL", str(e))
|
||||
|
||||
# Matched pairs
|
||||
test_file_exists('example_matched_pairs.png', 'matched pairs LSB')
|
||||
|
||||
# Scanline filter
|
||||
test_file_exists('example_scanline_filter.png', 'PNG scanline filter abuse')
|
||||
|
||||
# --- Document & archive (Chunk 12) ---
|
||||
|
||||
# PDF JavaScript
|
||||
try:
|
||||
data = (EXAMPLES_DIR / 'example_pdf_javascript.pdf').read_bytes()
|
||||
import base64 as b64mod
|
||||
b64 = b64mod.b64encode(PLINIAN_DIVIDER.encode('utf-8'))
|
||||
if b64 in data and b'/JavaScript' in data:
|
||||
record("example_pdf_javascript.pdf [JS]", "PASS", "JavaScript action with base64 divider")
|
||||
else:
|
||||
record("example_pdf_javascript.pdf [JS]", "FAIL", "JS or divider not found")
|
||||
except Exception as e:
|
||||
record("example_pdf_javascript.pdf [JS]", "FAIL", str(e))
|
||||
|
||||
# PDF incremental
|
||||
test_direct_search('example_pdf_incremental.pdf', 'PDF incremental update')
|
||||
|
||||
# PDF form fields
|
||||
test_direct_search('example_pdf_forms.pdf', 'PDF form fields')
|
||||
|
||||
# HTML events
|
||||
try:
|
||||
data = (EXAMPLES_DIR / 'example_html_events.html').read_bytes()
|
||||
text = data.decode('utf-8')
|
||||
has_events = 'onload=' in text and 'onclick=' in text
|
||||
has_hidden = 'type="hidden"' in text
|
||||
has_divider = PLINIAN_DIVIDER in text
|
||||
if has_events and has_hidden and has_divider:
|
||||
record("example_html_events.html [events]", "PASS",
|
||||
"Event handlers + hidden fields + divider")
|
||||
else:
|
||||
record("example_html_events.html [events]", "WARN",
|
||||
f"events={has_events}, hidden={has_hidden}, divider={has_divider}")
|
||||
except Exception as e:
|
||||
record("example_html_events.html [events]", "FAIL", str(e))
|
||||
|
||||
# XML entities
|
||||
try:
|
||||
data = (EXAMPLES_DIR / 'example_xml_entities.xml').read_bytes()
|
||||
text = data.decode('utf-8')
|
||||
has_entity = '<!ENTITY steg_payload' in text
|
||||
has_divider = PLINIAN_DIVIDER in text
|
||||
if has_entity and has_divider:
|
||||
record("example_xml_entities.xml [entities]", "PASS",
|
||||
"Entity declarations with divider")
|
||||
else:
|
||||
record("example_xml_entities.xml [entities]", "FAIL", "Missing entities or divider")
|
||||
except Exception as e:
|
||||
record("example_xml_entities.xml [entities]", "FAIL", str(e))
|
||||
|
||||
# Nested ZIP
|
||||
try:
|
||||
import zipfile
|
||||
with zipfile.ZipFile(EXAMPLES_DIR / 'example_nested.zip') as outer:
|
||||
names = outer.namelist()
|
||||
has_inner = any('inner.zip' in n for n in names)
|
||||
if has_inner:
|
||||
inner_data = outer.read('data/inner.zip')
|
||||
import io
|
||||
with zipfile.ZipFile(io.BytesIO(inner_data)) as inner:
|
||||
secret_data = inner.read('secret.txt').decode('utf-8')
|
||||
if PLINIAN_DIVIDER in secret_data:
|
||||
record("example_nested.zip [nested decode]", "PASS",
|
||||
"Plinian divider extracted from inner ZIP")
|
||||
else:
|
||||
record("example_nested.zip [nested decode]", "FAIL",
|
||||
f"Inner secret: {secret_data[:30]}")
|
||||
else:
|
||||
record("example_nested.zip [nested decode]", "FAIL", "No inner.zip")
|
||||
except Exception as e:
|
||||
record("example_nested.zip [nested decode]", "FAIL", str(e))
|
||||
|
||||
# Emoji skin tone
|
||||
try:
|
||||
data = (EXAMPLES_DIR / 'example_emoji_skin_tone.txt').read_bytes()
|
||||
text = data.decode('utf-8')
|
||||
skin_tones = sum(1 for c in text if 0x1F3FB <= ord(c) <= 0x1F3FF)
|
||||
if skin_tones > 10:
|
||||
record("example_emoji_skin_tone.txt [tones]", "PASS",
|
||||
f"{skin_tones} skin tone modifiers")
|
||||
else:
|
||||
record("example_emoji_skin_tone.txt [tones]", "FAIL",
|
||||
f"Only {skin_tones} modifiers")
|
||||
except Exception as e:
|
||||
record("example_emoji_skin_tone.txt [tones]", "FAIL", str(e))
|
||||
|
||||
# Punycode
|
||||
test_file_exists('example_punycode.txt', 'Punycode/IDN domains')
|
||||
test_b64_hex_search('example_punycode.txt', 'Punycode file')
|
||||
|
||||
# QR steg
|
||||
test_file_exists('example_qr_steg.txt', 'QR code steganography')
|
||||
test_b64_hex_search('example_qr_steg.txt', 'QR steg file')
|
||||
|
||||
# JPEG restart markers
|
||||
try:
|
||||
data = (EXAMPLES_DIR / 'example_jpeg_restart.jpg').read_bytes()
|
||||
has_com = b'\xFF\xFE' in data # COM marker
|
||||
has_steg = b'ST3GG' in data
|
||||
if has_com and has_steg:
|
||||
record("example_jpeg_restart.jpg [COM]", "PASS", "JPEG COM marker with ST3GG")
|
||||
else:
|
||||
record("example_jpeg_restart.jpg [COM]", "WARN", f"COM={has_com}, ST3GG={has_steg}")
|
||||
except Exception as e:
|
||||
record("example_jpeg_restart.jpg [COM]", "FAIL", str(e))
|
||||
|
||||
# PNG polyglot (already tested in section 10, but verify decode)
|
||||
try:
|
||||
data = (EXAMPLES_DIR / 'example_polyglot.png.zip').read_bytes()
|
||||
# Should be valid as both PNG and ZIP
|
||||
is_png = data[:8] == b'\x89PNG\r\n\x1a\n'
|
||||
import zipfile, io
|
||||
try:
|
||||
zf = zipfile.ZipFile(io.BytesIO(data))
|
||||
is_zip = True
|
||||
zip_names = zf.namelist()
|
||||
zf.close()
|
||||
except:
|
||||
is_zip = False
|
||||
zip_names = []
|
||||
if is_png and is_zip:
|
||||
record("example_polyglot.png.zip [polyglot]", "PASS",
|
||||
f"Valid PNG + ZIP ({len(zip_names)} files)")
|
||||
else:
|
||||
record("example_polyglot.png.zip [polyglot]", "WARN",
|
||||
f"PNG={is_png}, ZIP={is_zip}")
|
||||
except Exception as e:
|
||||
record("example_polyglot.png.zip [polyglot]", "FAIL", str(e))
|
||||
|
||||
# --- Audio DSP (Chunk 14) ---
|
||||
|
||||
for fname, desc in [
|
||||
('example_echo_hiding.wav', 'echo hiding'),
|
||||
('example_phase_coding.wav', 'phase coding'),
|
||||
('example_spread_spectrum.wav', 'spread spectrum DSSS'),
|
||||
('example_quantization_noise.wav', 'quantization noise'),
|
||||
]:
|
||||
if test_file_exists(fname, desc):
|
||||
# Verify valid WAV
|
||||
try:
|
||||
with wave.open(str(EXAMPLES_DIR / fname)) as w:
|
||||
record(f"{fname} [wav valid]", "PASS",
|
||||
f"WAV: {w.getnchannels()}ch, {w.getframerate()}Hz, {w.getnframes()} frames")
|
||||
except Exception as e:
|
||||
record(f"{fname} [wav valid]", "FAIL", str(e))
|
||||
|
||||
# --- Image DSP (Chunk 15) ---
|
||||
|
||||
for fname, desc in [
|
||||
('example_bpcs.png', 'BPCS bit-plane complexity'),
|
||||
('example_dct_manual.png', 'DCT coefficient embedding'),
|
||||
('example_dft.png', 'DFT magnitude embedding'),
|
||||
('example_dwt_haar.png', 'DWT Haar wavelet'),
|
||||
('example_subsampling.png', 'chroma subsampling'),
|
||||
]:
|
||||
if test_file_exists(fname, desc):
|
||||
try:
|
||||
img = Image.open(EXAMPLES_DIR / fname)
|
||||
record(f"{fname} [image valid]", "PASS",
|
||||
f"{img.size[0]}x{img.size[1]} {img.mode}")
|
||||
except Exception as e:
|
||||
record(f"{fname} [image valid]", "FAIL", str(e))
|
||||
|
||||
# --- Misc (Chunk 16) ---
|
||||
|
||||
# Self-extracting archive
|
||||
try:
|
||||
data = (EXAMPLES_DIR / 'example_self_extracting.sh').read_bytes()
|
||||
text = data.decode('utf-8')
|
||||
import base64 as b64mod
|
||||
b64_secret = b64mod.b64encode(PLINIAN_DIVIDER.encode('utf-8')).decode()
|
||||
if b64_secret in text and '#!/bin/sh' in text:
|
||||
record("example_self_extracting.sh [SFX]", "PASS", "Shell SFX with embedded payload")
|
||||
else:
|
||||
record("example_self_extracting.sh [SFX]", "FAIL", "Missing shebang or payload")
|
||||
except Exception as e:
|
||||
record("example_self_extracting.sh [SFX]", "FAIL", str(e))
|
||||
|
||||
# Extended attributes
|
||||
try:
|
||||
path = EXAMPLES_DIR / 'example_xattr.txt'
|
||||
if path.exists():
|
||||
try:
|
||||
attrs = os.listxattr(str(path))
|
||||
steg_attrs = [a for a in attrs if 'st3gg' in a]
|
||||
if steg_attrs:
|
||||
payload = os.getxattr(str(path), b'user.st3gg.payload')
|
||||
if payload == PLINIAN_DIVIDER.encode('utf-8'):
|
||||
record("example_xattr.txt [xattr decode]", "PASS",
|
||||
f"Plinian divider in xattr ({len(steg_attrs)} attrs)")
|
||||
else:
|
||||
record("example_xattr.txt [xattr decode]", "WARN",
|
||||
f"{len(steg_attrs)} attrs but payload mismatch")
|
||||
else:
|
||||
record("example_xattr.txt [xattr decode]", "WARN",
|
||||
"No st3gg xattrs (may not survive git)")
|
||||
except OSError:
|
||||
record("example_xattr.txt [xattr decode]", "WARN",
|
||||
"xattr not supported on this filesystem")
|
||||
except Exception as e:
|
||||
record("example_xattr.txt [xattr decode]", "FAIL", str(e))
|
||||
|
||||
# TLS cert
|
||||
test_file_exists('example_tls_cert.pem', 'TLS certificate fields')
|
||||
test_direct_search('example_tls_cert.pem', 'TLS cert')
|
||||
test_b64_hex_search('example_tls_cert.pem', 'TLS cert')
|
||||
|
||||
print()
|
||||
|
||||
# =============================================================================
|
||||
# SUMMARY
|
||||
# =============================================================================
|
||||
|
||||
Reference in New Issue
Block a user