SecPod

Learn Search

Search across all Learn content

← Back to Expressions & POVs
Steganography

Steganography

Steganography is an art of hiding a message, image, or file within another message, image, or file.

Oct 30, 2013By Thanga Prakash2 min read

Steganography is an art of hiding a message, image, or file within another message, image, or file.

Most images are used to hide the data. The flexibility of using images means that information can be hidden in a variety of ways. It can be scattered all over the image or inserted straight inside.

If data is inserted straight inside. we can find it easily using the below technique,

Hex Editor

like HexEdit, HxD on windows

using :%!xxd command on Linux

FF D8

FF D9

EOI (End Of Image) marker

Here is an example to insert data straight inside the image without any tool on windows:

  1. Create a test file with some data to hide. ( Here i used “hidden data.txt” )
  2. Take an image to which you need to hide. ( Here i used “original.jpg” )
  3. In Command prompt use the below command to hide the content.

copy /b original.jpg + "hidden data.txt" "hidden image.jpg"

A new image will be created with your data hidden. You can open and view that image normally.

But, to view the hidden content open that image in any Hex editor as mentioned above and see the hidden data at the end after the EOI marker.

Later, a quick obfuscation layer is added (Password or key) to hide the visibility of the data in the HEX format. To view the original message we need that key or password.

Here is an example to insert data inside the image using Outguess tool:outguess is one of the tool that allows the insertion of hidden information intothe redundant bits of data sources.

Data Hiding : outguess -k "secretkey" -d hidden.txt image.jpg out.jpg

Data Retrieval : outguess -k "secretkey" -r out.jpg hidden.txt

– Thanga Prakash

Featured Posts

Open The Most Effective Vulnerability Assessment Framework What Makes One Effective
The Most Effective Vulnerability Assessment Framework What Makes One Effective

Point of View

The Most Effective Vulnerability Assessment Framework What Makes One Effective

No single named standard makes a vulnerability assessment framework effective. This piece covers NIST, ISO, and CIS Controls, then breaks down what actually separates a working framework from a checklist, coverage, risk based prioritization, cadence, ownership, and a feedback loop.

Sep 11, 2026

Open Threat and Vulnerability Assessment How Risk Actually Gets Calculated
Threat and Vulnerability Assessment How Risk Actually Gets Calculated

Point of View

Threat and Vulnerability Assessment How Risk Actually Gets Calculated

A vulnerability alone doesn't tell the whole risk story. This piece breaks down how a threat and vulnerability assessment pairs technical weaknesses with real attacker context, walks through the six step process, and covers frameworks like NIST 800-30 and ISO 27005.

Sep 11, 2026

Open Vulnerability Assessment Services: What to Look For
Vulnerability Assessment Services: What to Look For

Point of View

Vulnerability Assessment Services: What to Look For

Choosing a vulnerability assessment provider means asking about actual coverage, scan frequency, and whether findings come with real prioritization or just a CVSS dump. This piece breaks down what strong vulnerability assessment services include, red flags to avoid, and questions to ask before signing.

Sep 11, 2026

Open Agentic AI Vulnerability Assessment What Changes and What Does Not
Agentic AI Vulnerability Assessment What Changes and What Does Not

Point of View

Agentic AI Vulnerability Assessment What Changes and What Does Not

Agentic AI is expanding what a vulnerability assessment needs to cover, autonomous agents bring their own credentials, tool access, and memory, adding a genuinely new asset class alongside servers and endpoints. It's also compressing attacker timelines and introducing risk categories like goal hijacking and tool misuse that don't map to a traditional CVE. But the core discipline hasn't changed: the same lifecycle of scoping, scanning, prioritizing, and remediating still applies, human judgment still drives prioritization, and accountability still sits with the people who deployed the agent, not the agent itself.

Sep 9, 2026