A field-tested toolkit of copy-ready commands for solving CTF steganography challenges, from first-pass triage through image and audio extraction to passphrase recovery. (28 payloads)
file suspicious.jpgexiftool -a -u -g1 image.jpgstrings -n 8 -e l file.binbinwalk file.pngbinwalk -e --dd='.*' file.pngforemost -i file.bin -o out_dir/xxd file.bin | head -n 40zsteg -a image.pngzsteg -E 'b1,rgb,lsb,xy' image.png > out.binsteghide extract -sf image.jpg -p ''steghide info image.jpgjava -jar stegsolve.jarconvert image.png -separate channel_%d.pngstegoveritas image.pngaudacity hidden.wavsox input.wav -n spectrogram -o spectro.pngsteghide extract -sf audio.wav -p ''multimon-ng -t wav -a MORSE_CW -a DTMF audio.wavunzip image.jpgcat cover.jpg secret.zip > polyglot.jpgdd if=file.jpg of=hidden.zip bs=1 skip=$OFFSET7z l file.png && 7z x file.pngpngcheck -v image.pngstegseek image.jpg /usr/share/wordlists/rockyou.txtstegseek --seed image.jpgfor p in $(cat words.txt); do steghide extract -sf img.jpg -p "$p" -xf out_$p 2>/dev/null && echo "HIT: $p"; donestegcracker image.jpg /path/to/wordlist.txtfcrackzip -u -D -p rockyou.txt secret.zipLevel up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides
It's a quick-reference collection of 28 Steganography payloads for testing Steganography vulnerabilities during authorized penetration testing, bug bounties, and CTFs. Every payload is copy-ready and grouped by attack context.
Copy any payload straight into your authorized test, or use the What Is This? to apply them interactively. Only test systems you have explicit permission to assess.
Yes — this cheat sheet and all Steganography payloads are completely free, with no account required. Everything runs in your browser.