Audit Portal

StegoTarget System Console

Security Operations Center (SOC) walkthrough guide and decryption walkthroughs.

🔍 Forensic Assessment Brief

This sandbox simulates a corporate website that has been compromised, or configured, to communicate metadata through **covert web channels**. Your assignment as the security auditor is to inspect the site's assets, protocols, and markup, identify the hidden flags, and document the exfiltration methods.

Below is the system console detailing the covert channels and the script tools needed to extract the flags.

1

HTTP Response Headers

Covert Header Detected

Covert Layer: Network Protocol (Response Headers)

Description: The server sends a custom header X-Internal-Routing-Token containing a Base64-encoded payload on every request.

Detection Command:

curl -I http://localhost/group5/index.php

Extraction Guide:

Inspect the output and extract the value of X-Internal-Routing-Token, then Base64 decode it.

echo "ZmxhZ3toZWFkZXJfZXhmaWx0cmF0aW9ufQ==" | base64 --decode # Output: flag{header_exfiltration}
2

Storage & Session Cookies

Covert Cookie Detected

Covert Layer: Storage / State Layer

Description: The site sets a persistent tracking cookie named _sec_session_state that stores a Hexadecimal representation of a flag.

Detection:

Open Browser DevTools (F12) → Go to Application/Storage tab → Expand Cookies → Select http://localhost. Look for the value of _sec_session_state.

Alternatively, inspect cookies via command-line:

curl -c - http://localhost/group5/index.php | grep _sec_session_state

Extraction Guide:

Convert the hex value (464c41477b636f6f6b69655f737465676f7d) to ASCII:

# In Python: python -c "print(bytes.fromhex('464c41477b636f6f6b69655f737465676f7d').decode('utf-8'))" # Output: FLAG{cookie_stego}
3

Source Code Comments & Attributes

Code Flags Detected

Covert Layer: Codebase / Markup Layer

Description: Flags are hidden within CSS stylesheets and HTML forms.

Detection (CSS):

Inspect the main stylesheet assets/styles.css. There is a flag comment at the top.

curl -s http://localhost/group5/assets/styles.css | head -n 3 # Output: /* EXFILTRATION NODE ID: FLAG{css_comment_style_881} */

Detection (HTML):

Inspect the contact form page sources on contact.php:

  1. There is an HTML comment in the form body containing a base64 encoded credential block: key_auth_v2=YWRtaW46c3VwZXJzZWNyZXRwYXNzMTIz (decodes to admin:supersecretpass123).
  2. There is a hidden form input containing a data-integrity-chk attribute:
<input type="hidden" name="form_security_hash" value="..." data-integrity-chk="FLAG{html_data_attr_102}">
4

Zero-Width Unicode Steganography

Text Channel Active

Covert Layer: Visual Text (Zero-Width Space Manipulation)

Description: The paragraph text inside the second card of privacy.php ("2. Data Security & Integrity") has a binary message hidden in its whitespace using Zero-Width Space (ZWSP, U+200B) representing 0 and Zero-Width Non-Joiner (ZWNJ, U+200C) representing 1.

Detection Method:

Copy the first paragraph of Section 2 from the website, then run this python script to extract the hidden Unicode bytes and decode them.

# zws_decoder.py import sys # Paste the copied text inside the quotes text = """We take data privacy very seriously and incorporate security protocols at every operational tier.""" binary = "" for char in text: if char == '\u200b': # Zero-Width Space represents 0 binary += '0' elif char == '\u200c': # Zero-Width Non-Joiner represents 1 binary += '1' if not binary: print("No zero-width characters found in text.") else: # Segment binary string into blocks of 8 bits (1 byte) flag_bytes = [binary[i:i+8] for i in range(0, len(binary), 8)] flag = "".join(chr(int(b, 2)) for b in flag_bytes if len(b) == 8) print("Decoded Secret Flag:", flag)
5

Image Least Significant Bit (LSB) Extraction

Pixel Carrier Detected

Covert Layer: Visual Media (Image Carrier)

Description: The CEO profile image (assets/team_ceo.png) on the about.php page contains a secret flag embedded in the least significant bit (bit 0) of the Red, Green, and Blue pixel channels.

Extraction Guide:

Download the image and run this Python script (requires the Pillow library) to extract the LSB bits from the pixels, reconstruct the binary stream, and display the secret flag.

# lsb_decoder.py from PIL import Image import urllib.request # Download image directly from target site img_url = "http://localhost/group5/assets/team_ceo.png" img_path = "team_ceo.png" urllib.request.urlretrieve(img_url, img_path) # Open image and read pixel channels img = Image.open(img_path) pixels = img.load() width, height = img.size binary_stream = "" for y in range(height): for x in range(width): r, g, b = pixels[x, y] # Read the 0th bit of Red, Green, Blue channels binary_stream += str(r & 1) binary_stream += str(g & 1) binary_stream += str(b & 1) # Group bits into 8-bit bytes bytes_list = [binary_stream[i:i+8] for i in range(0, len(binary_stream), 8)] decoded_chars = [] for b in bytes_list: byte_val = int(b, 2) if byte_val == 0: # Null terminator reached break decoded_chars.append(chr(byte_val)) flag = "".join(decoded_chars) print("Decoded LSB Flag:", flag)