search

Zeecka / AperiSolve

Steganalysis web platform
https://www.aperisolve.com/
The Unlicense
527 stars 57 forks source link

Steghide should work with empty password #8

Closed Zeecka closed 3 years ago

Maijin commented 3 years ago

Cool tool found via a Twitch Livestream H25io - could be nice to have it tries the submitted filename and the filename without the extension for example for a file named "hawking.jpeg", it should try "hawking" and "hawking.jpeg".

Zeecka commented 3 years ago

Thank you 👍🏻 . You mean to test the file name with/without extension as a password ? It could be a nice feature, but I think it would be too time consuming that's why I won't implement it. From experience Steghide/Outguess password are usually from a previous CTF/steganalysis step or from a wordlist such as rockyou (or worst, guessing from the image theme). It's very rare that the password of such challenge are contained in the file name.

Maijin commented 3 years ago

I think would be worth implementing, already one chall that had this, that's why I'm suggesting ;-).

I don't know how much time it takes to try one password but as a user, I'd be fine waiting couple of minutes for some additional extensive checks like this one (and even the wordlist), as long as the rest of the information is already displayed and I can already start looking at the rest of output.

Zeecka commented 3 years ago

And finally the last one... fixed 😉 (no need to specify you're using an empty password). I'm going to push my new code. Thank you for your interest in Aperi'Solve. Feel free to make Pull Requests for futures issues. 😃