Puzzle Hex / steganography problem
So I am having a puzzle to solve. I tried solving it but I don’t know the exact approach for that. If possible someone helps me to solve this.
Puzzle link:-
https://ibb.co/HXkxmXJ
I tried using hex editor but couldn’t find any valuable data. Then I tried opening the “png” file with Notepad++ so I found some “RDF” code in it.
But I am clueless what is need to be done with that. I am pasting the same code in this as well. Kindly see it and let me know the approach.
<x:xmpmeta xmlns:x=“adobe:ns:meta/” x:xmptk=“XMP Core 5.4.0”>
<rdf:RDF xmlns:rdf=“http://www.w3.org/1999/02/22-rdf-syntax-ns#”>
<rdf:Description rdf:about=“”
xmlns:exif=“http://ns.adobe.com/exif/1.0/”
xmlns:tiff=“http://ns.adobe.com/tiff/1.0/”>
<exif:PixelYDimension>960</exif:PixelYDimension>
<exif:PixelXDimension>1306</exif:PixelXDimension>
<tiff:Orientation>1</tiff:Orientation>
</rdf:Description>
</rdf:RDF>
</x:xmpmeta>
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘\’‘ at line 1
You need to upload it to another host and place a link here. Maybe it works on imgur? https://imgur.com/upload
Ok I think you can use this link https://ibb.co/HXkxmXJ. I have uploaded the image in this.
Your hexdata looks a bit mixed up. In the last row you can find something that could be broken JFIF-Data. There is the SOI(Start of Image)=FF D8 followed by an APP0 (JFIF tag) = FF E0. The following data for the APP0 is inconsistent.
In the first line you have the same, if you switch the byte-order wordwise (From D8 FF to FF D8). This Data is inconsistent too.
The middlepart seems to be displayable chars, that I’d say on the first view could be a shiftcipher or smth
What you are talking about is some information provided in a “iTXt”-Chunk (see http://www.libpng.org/pub/png/spec/1.2/PNG-Chunks.html) there is nothing special about this. The Checksum of all chunks is ok. I’m not sure, but I think it is not the image itself, but the hexdata that is shown
If you look at that middle-part I’ve mentioned before. If you switch the byte-order wordwise too for this part you will get a clean text message:
..someRandomCharacters..
Only an illusive mind with illusive thoughts can bear to see reality, As illusion once created are now reality. Isn’t it?
Congrats, You have made it here!
Now, Tell us about your favorite Hack - Postman Security Team
..someRandomCharact
So it seems the last line shall bring you to the JFIF-Format-Headers, and recognizing that the first line is byteswitched brings you the hint for the encoded message of the middlepart
I can’t. The only thing I can do is to list the steps:
- type the values from the image into a hex-editor to create the shown file
- recognizing the string JFIF on the bottom of the file
- read reference-papers about the JFIF (Jpeg File Interchange Format)
- try to understand what is at the bottom with that papers (check every byte in that format if it makes sense)
- recognize that these headers are on the top of the file in switched byteorder
- recognize that everything between the 1st and the last line is printable ascii
- recognize this byteorder is switched too
- decode the message by ordering the bytes
@4n1mu5 Please provide a source if you need help, we are not allowed to help an on-going CTF challenge etc
If you need help tell us first if it’s a wargame website, “just had the image nothing else” is not an answer.
Message me anytime!