💾
DuckDuckNo
/
...
/
🏁
Challenges
/
1 Hidden text
Search
Duplicate
Notion
1 Hidden text
Tags
Stego
Solved
DESCRIPTION
Network team has captured a text file from network traffic. One analyst noticed that the file size does not match the content. Possibly something is hidden.
QUESTION
Analyze the file and read the secret text.
SOLUTION
E2 80 8B
E2 80 8D
Some bits used for data transfer?
Correct. Third least significant bit used for data transfer.
>>> bits = list(map(lambda x: 1 if x == "8d" else 0, onlybytes)) >>> bits [0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 0, 1, 1, 0, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1, 1, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 1, 0, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 1, 1, 0, 0, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 0, 1, 0, 0, 1, 1, 0, 1, 1, 1, 1, 0, 1, 1, 1, 1, 0, 0, 0, 0]
Python
Flag: whitespace-rox
root@cboekali-100:~# cat y.txt | tail -c +109 | xxd -c 3 00000000: e280 8b ... 00000003: e280 8d ... 00000006: e280 8b ... 00000009: e280 8b ... 0000000c: e280 8b ... 0000000f: e280 8d ... 00000012: e280 8d ... 00000015: e280 8b ... 00000018: e280 8b ... 0000001b: e280 8d ... 0000001e: e280 8d ... 00000021: e280 8b ... 00000024: e280 8d ... 00000027: e280 8d ... 0000002a: e280 8b ... 0000002d: e280 8b ... 00000030: e280 8b ... 00000033: e280 8d ... 00000036: e280 8d ... 00000039: e280 8b ... 0000003c: e280 8b ... 0000003f: e280 8b ... 00000042: e280 8b ... 00000045: e280 8d ... 00000048: e280 8b ... 0000004b: e280 8d ... 0000004e: e280 8d ... 00000051: e280 8b ... 00000054: e280 8b ... 00000057: e280 8d ... 0000005a: e280 8d ... 0000005d: e280 8d ... 00000060: e280 8b ... 00000063: e280 8b ... 00000066: e280 8d ... 00000069: e280 8b ... 0000006c: e280 8b ... 0000006f: e280 8b ... 00000072: e280 8b ... 00000075: e280 8b ... 00000078: e280 8b ... 0000007b: e280 8d ... 0000007e: e280 8d ... 00000081: e280 8b ... 00000084: e280 8d ... 00000087: e280 8b ... 0000008a: e280 8b ... 0000008d: e280 8d ... 00000090: e280 8b ... 00000093: e280 8d ... 00000096: e280 8d ... 00000099: e280 8d ... 0000009c: e280 8b ... 0000009f: e280 8b ... 000000a2: e280 8d ... 000000a5: e280 8d ... 000000a8: e280 8b ... 000000ab: e280 8b ... 000000ae: e280 8d ... 000000b1: e280 8d ... 000000b4: e280 8d ... 000000b7: e280 8b ... 000000ba: e280 8d ... 000000bd: e280 8b ... 000000c0: e280 8b ... 000000c3: e280 8b ... 000000c6: e280 8d ... 000000c9: e280 8b ... 000000cc: e280 8b ... 000000cf: e280 8b ... 000000d2: e280 8b ... 000000d5: e280 8b ... 000000d8: e280 8b ... 000000db: e280 8d ... 000000de: e280 8d ... 000000e1: e280 8d ... 000000e4: e280 8b ... 000000e7: e280 8d ... 000000ea: e280 8d ... 000000ed: e280 8d ... 000000f0: e280 8b ... 000000f3: e280 8d ... 000000f6: e280 8d ... 000000f9: e280 8b ... 000000fc: e280 8d ... 000000ff: e280 8b ... 00000102: e280 8b ... 00000105: e280 8b ... 00000108: e280 8b ... 0000010b: e280 8d ... 0000010e: e280 8d ... 00000111: e280 8b ... 00000114: e280 8d ... 00000117: e280 8b ... 0000011a: e280 8b ... 0000011d: e280 8d ... 00000120: e280 8b ... 00000123: e280 8d ... 00000126: e280 8d ... 00000129: e280 8d ... 0000012c: e280 8b ... 0000012f: e280 8d ... 00000132: e280 8b ... 00000135: e280 8b ... 00000138: e280 8b ... 0000013b: e280 8d ... 0000013e: e280 8d ... 00000141: e280 8b ... 00000144: e280 8b ... 00000147: e280 8d ... 0000014a: e280 8b ... 0000014d: e280 8d ... 00000150: e280 8b ... 00000153: e280 8d ... 00000156: e280 8d ... 00000159: e280 8d ... 0000015c: e280 8b ... 0000015f: e280 8b ... 00000162: e280 8d ... 00000165: e280 8d ... 00000168: e280 8b ... 0000016b: e280 8d ... 0000016e: e280 8d ... 00000171: e280 8d ... 00000174: e280 8b ... 00000177: e280 8b ... 0000017a: e280 8b ... 0000017d: e280 8b ... 00000180: e280 8b ... 00000183: e280 8d ... 00000186: e280 8d ... 00000189: e280 8b ... 0000018c: e280 8b ... 0000018f: e280 8b ... 00000192: e280 8b ... 00000195: e280 8d ... 00000198: e280 8b ... 0000019b: e280 8d ... 0000019e: e280 8d ... 000001a1: e280 8b ... 000001a4: e280 8b ... 000001a7: e280 8b ... 000001aa: e280 8d ... 000001ad: e280 8d ... 000001b0: e280 8b ... 000001b3: e280 8d ... 000001b6: e280 8d ... 000001b9: e280 8b ... 000001bc: e280 8b ... 000001bf: e280 8d ... 000001c2: e280 8b ... 000001c5: e280 8d ... 000001c8: e280 8b ... 000001cb: e280 8b ... 000001ce: e280 8d ... 000001d1: e280 8b ... 000001d4: e280 8d ... 000001d7: e280 8d ... 000001da: e280 8b ... 000001dd: e280 8d ... 000001e0: e280 8b ... 000001e3: e280 8d ... 000001e6: e280 8d ... 000001e9: e280 8d ... 000001ec: e280 8b ... 000001ef: e280 8b ... 000001f2: e280 8d ... 000001f5: e280 8b ... 000001f8: e280 8b ... 000001fb: e280 8d ... 000001fe: e280 8d ... 00000201: e280 8b ... 00000204: e280 8d ... 00000207: e280 8d ... 0000020a: e280 8d ... 0000020d: e280 8d ... 00000210: e280 8b ... 00000213: e280 8d ... 00000216: e280 8d ... 00000219: e280 8d ... 0000021c: e280 8d ... 0000021f: e280 8b ... 00000222: e280 8b ... 00000225: e280 8b ... 00000228: 0a .
Plain Text
Likely 3rd least significant byte used for data encoding
>>> print("{:b}".format(0xe2808b)) 111000101000000010001011 >>> print("{:b}".format(0xe2808d)) 111000101000000010001101
Python