Neven Marić
Hidden Investigations CTF 2026

SteganographyHidden Investigations CTF 2026

Zanzibar Whisper

A single JPEG (zanzibar_whisper.jpg, a Xinhua news photo of a boy jumping into the sea in Zanzibar) hides a message. The data is embedded with steghide using an empty passphrase.

  • steganography
  • jpeg
  • steghide
  • empty-passphrase

What this one teaches

  • Always try steghide with an empty passphrase on JPEG challenges — it is the most common default.
  • A clean JPEG (no appended data, no EXIF, no comments) with no obvious anomalies still warrants a steghide check.

Task description

A mysterious image from the shores of Zanzibar has surfaced. Locals say it carries a hidden message — a whisper from the Spice Island. Can you uncover its secret?

Approach

Checked for appended data: the file ends exactly at the JPEG EOI marker (FFD9), and there are no PK/PNG/Rar/7z signatures inside. Parsed JPEG segments: only JFIF, DQT, SOF0, DHT and SOS, with no EXIF or comment metadata.

Since the carrier is a JPEG (steghide is the standard tool), ran steghide with a few likely passphrases. The empty one worked:

steghide extract -sf zanzibar_whisper.jpg -p "" -xf flag.txt

Output: wrote extracted data to "flag.txt", containing hiCTF{sp1c3_1sl4nd_s3cr3ts}.

The flagRevealhiCTF{sp1c3_1sl4nd_s3cr3ts}

This CTF was possibly solved, and the writeup most likely written by an LLM. Apologies for inconsistencies.