🚩 CTF-TOOLS — Image Forensics & Steganography Toolkit

A collection of Python-based image forensics, repair, and steganography tools for Capture The Flag (CTF) competitions.

Repair corrupted image files, validate headers, fix CRC checksums, extract LSB-hidden flags across multiple encodings, and recover hidden data from PNG, JPEG, GIF, and BMP files — essential tools for solving steganography and forensics challenges.

---

📋 Table of Contents

• Tools Included
• Features
• Tech Stack
• Installation
• Usage
• How It Works
• Supported Formats
• Contributing

---

🧰 Tools Included

Tool	Purpose	Supported Formats
Image-Fixer.py	Universal image repair — validates magic bytes, parses chunks, fixes headers	PNG, JPEG, GIF, BMP
OriginalPNG-fixer.py	Interactive PNG repair — CRC validation, chunk type repair, manual header correction	PNG
png-fixer.py	Automated PNG repair — header alignment, IHDR detection, chunk integrity validation	PNG
lsb_flag_finder.py	Extract LSB data → decode across ASCII, Base64, Base32, ROT13 → auto-grep CTF flags	PNG, BMP, TIFF

---

🚀 Features

Feature	Description
Magic Byte Validation	Detects and repairs corrupted file headers (PNG signature, JPEG SOI, GIF87a/89a, BMP)
Chunk Parsing	Parses image file chunks (IHDR, IDAT, IEND, PLTE, tEXt, etc.) with proper length validation
CRC Verification	Validates CRC32 checksums for each chunk and auto-repairs mismatches
Header Injection	Inserts missing JFIF/Exif headers in JPEG files
IHDR Alignment	Detects misaligned IHDR chunks in PNG files and realigns to correct offset
Interactive Repair	OriginalPNG-fixer offers manual chunk type selection for complex corruptions
Auto-Truncation	Removes trailing garbage data after IEND chunk
Multi-Format	Single tool (Image-Fixer.py) handles PNG, JPEG, GIF, and BMP formats
LSB Extraction	Extracts 1–4 bit LSB data from any combination of R, G, B, A channels
Multi-Encoding Decode	Decodes extracted data as ASCII, Base64, Base32, and ROT13 simultaneously
Flag Auto-Grep	Regex-based search for common CTF flag formats (flag{}, CTF{}, picoCTF{}, HTB{}, etc.)
Custom Flag Patterns	Support for custom flag regex via --flag-format for any CTF competition

---

🛠️ Tech Stack

Component	Technology	Role
Language	Python 3.x	Core programming language
Binary Parsing	struct	Unpacking binary data (big-endian chunk lengths, CRC values)
Checksum	binascii.crc32	CRC32 computation for PNG chunk validation
I/O	sys + file I/O	Command-line args and binary file read/write
Architecture	OOP (FileRepairer class)	Modular, extensible repair framework
Image Processing	Pillow (PIL)	Pixel-level access for LSB extraction
Encoding	base64, codecs	Base64, Base32, ROT13 decoding
Pattern Matching	re (regex)	Flag format detection across encodings

---

📦 Installation

# Clone the repository
git clone https://github.com/cazy8/CTF-TOOLS.git
cd CTF-TOOLS

# No external dependencies required — uses Python standard library only
python3 --version  # Requires Python 3.6+

Zero dependencies — all tools use only the Python standard library (struct, binascii, sys).

---

⚙️ Usage

Image-Fixer.py (Universal — PNG/JPEG/GIF/BMP)

python3 Image-Manipulation/Image-Fixer.py <input_image> <output_image>

# Fix a corrupted PNG
python3 Image-Manipulation/Image-Fixer.py corrupted.png fixed.png

# Fix a broken JPEG
python3 Image-Manipulation/Image-Fixer.py broken.jpg repaired.jpg

# Repair a GIF file
python3 Image-Manipulation/Image-Fixer.py challenge.gif solved.gif

OriginalPNG-fixer.py (Interactive PNG Repair)

python3 Image-Manipulation/OriginalPNG-fixer.py <input.png> <output.png>

• Walks through each chunk interactively
• Prompts for manual chunk type selection when type is invalid
• Shows expected vs actual CRC values
• Auto-repairs CRC mismatches and length errors

png-fixer.py (Automated PNG Repair)

python3 Image-Manipulation/png-fixer.py <input.png> <output.png>

• Fully automated — no user interaction needed
• Best for quick fixes during timed CTF competitions

lsb_flag_finder.py (LSB Steganography — Flag Extraction)

# Install dependency
pip install Pillow

# Basic — extract 1-bit LSB from RGB and search all encodings
python3 LSB-Flag-Finder/lsb_flag_finder.py image.png

# Extract 2-bit LSB from Red and Green channels only
python3 LSB-Flag-Finder/lsb_flag_finder.py image.png --bits 2 --channels RG

# Search only in Base64-decoded output
python3 LSB-Flag-Finder/lsb_flag_finder.py image.png --encoding base64

# Custom flag format for a specific CTF
python3 LSB-Flag-Finder/lsb_flag_finder.py image.png --flag-format "myctf{.*}"

# Verbose — show decoded previews even without flag matches
python3 LSB-Flag-Finder/lsb_flag_finder.py image.png -v

# Dump raw LSB bytes for manual analysis
python3 LSB-Flag-Finder/lsb_flag_finder.py image.png --raw > lsb_dump.bin

Example Output:

$ python3 LSB-Flag-Finder/lsb_flag_finder.py challenge.png
[*] Extracting 1-bit LSB from RGB channels …
[*] Got 921,600 bytes

[+] FLAGS FOUND  [ASCII]
    >>> flag{lsb_is_the_classic_stego}

[+] FLAGS FOUND  [ROT13]
    >>> flag{rot13_hidden_message}

Flag	Default	Description
--bits	1	LSBs to extract per channel (1–4)
--channels	RGB	Channels to read (any combo of R, G, B, A)
--encoding	all	ascii, base64, base32, rot13, or all
--flag-format	—	Custom regex for your CTF's flag format
--raw	—	Dump raw bytes to stdout
-v	—	Verbose — show previews without flag matches

---

🔬 How It Works

PNG File Structure

┌──────────────────┐
│  PNG Signature    │  8 bytes: 89 50 4E 47 0D 0A 1A 0A
├──────────────────┤
│  IHDR Chunk       │  Image header (width, height, bit depth, color type)
├──────────────────┤
│  PLTE Chunk       │  Palette (optional, for indexed color images)
├──────────────────┤
│  IDAT Chunk(s)    │  Compressed image data (can be multiple)
├──────────────────┤
│  tEXt/iTXt        │  Metadata chunks (may contain hidden flags!)
├──────────────────┤
│  IEND Chunk       │  End marker
└──────────────────┘

Each chunk:
┌────────┬────────┬──────────────┬─────────┐
│ Length  │  Type  │     Data     │   CRC   │
│ 4 bytes│ 4 bytes│ Length bytes  │ 4 bytes │
└────────┴────────┴──────────────┴─────────┘

Repair Pipeline

Input File → Validate Magic Bytes → Fix Header if Invalid
                                          │
                                          ▼
                                   Parse Chunks
                                          │
                              ┌───────────┼───────────┐
                              ▼           ▼           ▼
                         Validate    Validate     Validate
                          Type       Length         CRC
                              │           │           │
                              ▼           ▼           ▼
                         Repair if   Repair if   Repair if
                          Invalid     Invalid     Invalid
                              │           │           │
                              └───────────┼───────────┘
                                          ▼
                                   Write Output

---

📝 Supported Formats

Format	Magic Bytes	Tools
PNG	89 50 4E 47 0D 0A 1A 0A	All three tools
JPEG/JPG	FF D8 FF	Image-Fixer.py
GIF	47 49 46 38 37 61 (GIF87a)	Image-Fixer.py
BMP	42 4D (BM)	Image-Fixer.py

Validated PNG Chunk Types

IHDR  PLTE  IDAT  IEND  bKGD  cHRM  dSIG  eXIf
gAMA  hIST  iCCP  iTXt  pHYs  sBIT  sPLT  sRGB
sTER  tEXt  tIME  tRNS  zTXt

---

💡 CTF Tips

Scenario	Tool to Use	What to Look For
Image won't open	Image-Fixer.py	Corrupted magic bytes / header
PNG shows wrong dimensions	OriginalPNG-fixer.py	Modified IHDR width/height values
CRC error in PNG viewer	png-fixer.py	Intentionally broken CRC (common CTF trick)
Hidden data in metadata	OriginalPNG-fixer.py	Suspicious tEXt/iTXt chunks
JPEG missing JFIF header	Image-Fixer.py	SOI present but APP0 missing
Flag hidden after IEND	Manual hex analysis	Data appended after PNG end marker
Flag hidden in LSB	lsb_flag_finder.py	LSB steganography across RGB/A channels
Encoded flag in image	lsb_flag_finder.py	Base64/Base32/ROT13 encoded flags in pixel data

---

📁 Project Structure

CTF-TOOLS/
├── Image-Manipulation/
│   ├── Image-Fixer.py           # Universal format repair (OOP-based)
│   ├── OriginalPNG-fixer.py     # Interactive PNG-specific repair
│   └── png-fixer.py             # Automated PNG repair
├── LSB-Flag-Finder/
│   ├── lsb_flag_finder.py       # LSB extraction + multi-encoding flag grep
│   └── requirements.txt         # Pillow dependency
├── LICENSE                       # GPL v3
└── README.md                     # Documentation

---

🤝 Contributing

Contributions welcome! Ideas for expansion:

• 🔊 Audio Forensics — WAV/MP3 header repair and spectrogram analysis
• 📦 ZIP/RAR Repair — Archive header fixing for misc challenges
• � PCAP Analysis — Network forensics toolkit
• 🧮 Crypto Helpers — Common cipher solvers (Caesar, XOR, Vigenère)
• 🔍 Hex Analysis — Automated hidden data detection after IEND/EOF markers

---

👤 Author

Harsh Gupta — @cazy8 · LinkedIn

---

📜 License

This project is licensed under the GNU General Public License v3.0 — see the LICENSE file for details.

---

If you found this useful, consider giving it a ⭐