Stegseek

Stegseek brute-forces a Steghide passphrase against a wordlist and, the moment it hits, extracts the hidden payload for you. Reach for it whenever steghide extract asks for a passphrase you do not have: it parses the embedded header directly, so a full rockyou run finishes in seconds instead of the hours a scripted loop would take.

Mental model: stegseek [stegofile] [wordlist] [output]. Give it a carrier and a wordlist; skip the output and it auto-names the payload from the filename Steghide stored.

Install, update, verify#

sudo apt install -y stegseek                 # Kali (in the repos)
sudo apt install -y ./stegseek_*.deb         # Debian / Ubuntu via the release .deb
sudo apt install --only-upgrade -y stegseek  # update

stegseek --version    # version banner
command -v stegseek   # confirm it is on PATH
stegseek --help       # list crack/seed modes and options

The .deb release pulls in the Steghide libraries it depends on; build from source only for a feature that is not packaged yet. If command -v prints nothing, the package did not install or your shell PATH is stale, so open a new terminal or reinstall.

Flags you’ll actually use#

Skim these first; the cheat sheet below is these flags combined.

Cheat sheet#

Every block starts simple and adds one flag at a time, so you can stop at the line that does the job.

# Confirm it is even a Steghide carrier first
file CARRIER                                   # expect JPEG, BMP, WAV, or AU

# Try no passphrase before brute forcing
steghide extract -sf CARRIER -p ''             # empty-passphrase extract

# Build up a crack: stop at the line you need
stegseek CARRIER WORDLIST                       # 1. crack, payload auto-named
stegseek CARRIER WORDLIST -xf loot/out.bin      # 2. + write the payload where you want
stegseek CARRIER WORDLIST -xf loot/out.bin -q   # 3. + drop the progress bar for clean logs
stegseek CARRIER WORDLIST -xf loot/out.bin -s   # 4. + skip the built-in default test

# Explicit flags (scripts and notes)
stegseek -sf CARRIER -wl WORDLIST -xf loot/out.bin

# Seed mode: no wordlist, prove a payload exists / recover empty-passphrase data
stegseek --seed CARRIER
stegseek --seed CARRIER -xf loot/seed-out.bin

# Speed and force
stegseek CARRIER WORDLIST -t 8                  # pin 8 threads (default is all cores)
stegseek CARRIER WORDLIST -xf loot/out.bin -f   # overwrite an existing output file

# Batch many candidates against one list
for f in files/*.jpg; do echo "== $f =="; stegseek "$f" WORDLIST -q; done

# Inspect what you recovered before opening it
file loot/out.bin                               # text, archive, another image?
strings loot/out.bin | head                     # quick peek at readable content

Command breakdowns#

Each block below explains one situation, the exact command, and what to expect back.

Confirm a file is a Steghide carrier#

file CARRIER

Steghide only embeds in JPEG, BMP, WAV, and AU. If file reports a PNG, GIF, or PDF, stop - Stegseek cannot help, and you want zsteg, binwalk, or exiftool instead.

Try the empty passphrase before brute forcing#

steghide extract -sf CARRIER -p ''

Many challenges embed with no passphrase at all. This extracts instantly when that is the case and saves a pointless rockyou run. If it fails, move to Stegseek.

Crack a Steghide passphrase against rockyou#

stegseek CARRIER /usr/share/wordlists/rockyou.txt

rockyou is the usual first list on Kali. A hit prints Found passphrase: "...", the stored original filename, and an Extracting to line. With no -xf, the payload lands in the working directory under its embedded name.

Save the recovered payload to a chosen path#

stegseek CARRIER /usr/share/wordlists/rockyou.txt -xf loot/payload.bin

-xf sends the payload to a path you control instead of dropping it beside you. This is the command you will run most.

Use explicit flags for a scripted run#

stegseek -sf CARRIER -wl WORDLIST -xf loot/out.bin

-sf, -wl, and -xf name each file unambiguously, so a note or script never depends on positional order. Same result as the positional form.

Prove a payload exists with seed mode#

stegseek --seed CARRIER

Seed mode brute-forces the file’s random seed instead of a passphrase and needs no wordlist. A recovered seed confirms the file really is a Steghide carrier - useful triage before you commit to a long crack.

Recover an empty-passphrase payload with seed mode#

stegseek --seed CARRIER -xf loot/seed-out.bin

When a file was embedded with no passphrase, seed mode both confirms it and writes the payload out, so one command proves scope and recovers the data at once.

Skip the built-in default test#

stegseek CARRIER WORDLIST -s

By default Stegseek tries the empty passphrase and a few common ones before your list. -s (--skipdefault) skips that when you only care about the wordlist or when the default test muddies scripted output.

Speed up a big wordlist with threads#

stegseek CARRIER /usr/share/wordlists/rockyou.txt -t 8

Stegseek defaults to one thread per core; -t pins an explicit count. It is already fast, so this matters mainly on very large lists or a shared box.

Overwrite an existing payload file#

stegseek CARRIER WORDLIST -xf loot/out.bin -f

By default Stegseek refuses to clobber an existing output file. -f (--force) overwrites it, handy when you re-run a crack into the same loot path.

Keep logs clean and captured#

stegseek CARRIER WORDLIST -q | tee notes/stegseek.txt

-q drops the progress bar so only the result line remains; tee shows it and saves a copy for the writeup in one shot.

Sweep many candidate files at once#

for f in files/*.jpg; do echo "== $f =="; stegseek "$f" WORDLIST -q; done | tee notes/batch.txt

Loops one wordlist over every candidate and labels each result block, so you can spot which carrier actually hid something.

Identify the recovered payload before opening it#

file loot/payload.bin && strings loot/payload.bin | head

The payload could be text, an archive, or another image. file tells you the type and strings peeks at readable content, so you pick the right next step instead of opening it blind.

Reading the output#

Always run file on the recovered payload before trusting or opening it: the extract line is a filename, not proof of the contents.

Troubleshooting#

Gotchas#

• Steghide only touches JPEG, BMP, WAV, and AU. A PNG “stego” image is a different technique entirely, so no wordlist size will ever crack it here.
• Check the empty passphrase first. Stegseek’s default test covers it, but a bare steghide extract -sf CARRIER -p '' is instant and loads no wordlist at all.
• Seed mode is a presence test, not a passphrase cracker. It recovers the seed (and empty-passphrase data), not a real passphrase, so use it to decide whether cracking is even worth it.
• -f means overwrite, not “try harder”. It only lets Stegseek clobber an existing output file; it loosens no check on the payload.
• A hit is only as trustworthy as file on the payload. A wrong carrier can produce a zero-byte or junk extract, so identify the output before you build a theory on it.
• rockyou may still be gzipped. A fresh Kali ships /usr/share/wordlists/rockyou.txt.gz; gunzip it or Stegseek reads an empty list and reports no passphrase.

Pairs with#

steghide is the other half: extract once Stegseek hands you the passphrase, embed to build your own labs. When file says the carrier is not JPEG/BMP/WAV/AU, reach for zsteg (PNG/BMP LSB), binwalk (appended or carved files), or exiftool (metadata, which often hides the passphrase itself). Feed a recovered hash or encrypted archive into john or hashcat, and pull more wordlists from seclists when rockyou comes up empty. stegcracker does the same job by looping steghide extract, but it is far slower, and Stegseek has effectively replaced it.