GitHub - Nour833/StegoForge: The ultimate steganography and digital forensics toolkit. Hide and extract data across images, audio, video, documents, and network packets, or run 11 advanced detection engines to uncover hidden payloads.

The ultimate hybrid of steganography, digital forensics, and covert communications.

# 1. Hide a file inside an image (AES-256-GCM encrypted, auto-method)
stegoforge encode -c photo.png -p secret.pdf -k "my-pass"

# 2. Retrieve the hidden file
stegoforge decode -f photo_stego.png -k "my-pass"

# 3. CTF one-click forensic dump on any suspicious file
stegoforge ctf -f suspicious.mp3

# 4. Compare original vs stego — pixel heatmap
stegoforge diff -c photo.png -s photo_stego.png

# 5. Batch embed a secret into every carrier in a folder
stegoforge batch -d ./carriers/ -p secret.txt -k "my-pass"

# 6. Check capacity and stealth score of a carrier
stegoforge capacity -c photo.png --depth 2

# 7. Simulate Twitter recompression and test payload survives
stegoforge encode -c photo.png -p secret.txt -k "my-pass" --target twitter --test-survival

# 8. Launch the local web UI (no data ever leaves your machine)
stegoforge web

# Install tab-completion (bash)
eval "$(stegoforge completion bash)"

# Use env var to avoid key in shell history
export STEGOFORGE_KEY="my-pass"
stegoforge decode -f stego.png   # key read from env

$ stegoforge encode --carrier cover.png --payload secret.txt --key "mypassword" --method lsb
[+] Payload encrypted with AES-256-GCM
[+] Embedded 2048 bits across RGB channels (1-bit depth)
[+] Output: cover_stego.png
[+] Statistical profile: indistinguishable from baseline (chi² = 0.021)

$ stegoforge ctf --file suspicious.mp3
[*] Running all detectors on suspicious.mp3 ...
[⏭] Chi-square LSB anomaly      SKIPPED
[⏭] RS analysis                 SKIPPED 
[!] Blind extractor found payload at: audio-lsb, depth=1, AES encrypted blob
[+] Extracted 412 bytes → saved to extracted_payload.bin

stegoforge/
├── Image Carriers          PNG · JPEG · BMP · GIF · WebP
│   ├── LSB / Adaptive LSB  1–4 bit depth + WOW-style content-aware cost ordering
│   ├── DCT + JND-safe cap  JPEG frequency-domain embedding + Watson-style perceptual budget
│   ├── Fingerprint LSB     PRNU-aware embedding mode
│   └── Alpha / Palette     Transparency and indexed-color channels
│
├── Video Carriers          MP4 · WebM
│   ├── Video DCT           Keyframe embedding with block-cost ranking
│   └── Video Motion        Temporal+texture masked block embedding (MP4)
│
├── Audio Carriers          WAV · FLAC · MP3 · OGG
│   ├── Sample LSB          Psychoacoustic-style cost-ordered PCM LSB
│   ├── Phase coding        Segment-phase encoding
│   └── Spectrogram art     Visual payloads in spectrum domain
│
├── Document Carriers       TXT · PDF · DOCX · XLSX
│   ├── Unicode whitespace  Adaptive insertion-point ranking (ZWSP/ZWNJ/ZWJ)
│   ├── Linguistic mode     Key-aware synonym-channel text steganography
│   ├── PDF streams         Object/stream/metadata injection
│   └── Office XML          Custom XML parts and streams
│
├── Binary Carriers         ELF · PE/EXE/DLL (CLI)
│   ├── ELF slack/notes     2-bit masked region-cost embedding
│   └── PE slack/overlay    2-bit masked region-cost embedding
│
├── Network Covert Channels (CLI)
│   ├── TCP field channels  ip_id, tcp_seq, ttl
│   └── Timing channel      Inter-packet delay encoding
│
├── Crypto + Survivability
│   ├── AES-256-GCM + Argon2
│   ├── Decoy mode          Dual-payload plausible deniability
│   ├── Wet-paper wrapping  Reed-Solomon resilience wrapper
│   └── Platform profiles   Social-media-aware method selection/simulation
│
└── Interfaces
  ├── CLI                 Hybrid-first grouped method selection + full command mode
  ├── Web UI (Flask)      Grouped method pills, hybrid badges, local SSE streaming
  └── CTF mode            One command, all relevant detectors, ranked report

git clone https://github.com/Nour833/StegoForge.git
cd StegoForge
pip install -r requirements.txt
pip install -r requirements-web.txt
pip install -e .

stegoforge web  # Automatically deploys at http://localhost:5000

# Basic LSB into PNG
stegoforge encode -c photo.png -p message.txt -k "passphrase"

# Stealth JPEG DCT with custom bit depth
stegoforge encode -c photo.jpg -p secret.bin -k "key" --method dct

# Spectrogram Art — Hide a visual image inside playable audio
stegoforge encode -c music.wav -p logo.png --method spectrogram

# Decoy mode — Generates two keys, hiding two payloads in one file for plausible deniability
stegoforge encode -c photo.png -p real_secret.txt -k "realkey" \
                  --decoy decoy_message.txt --decoy-key "duresskey"

stegoforge decode -f photo_stego.png -k "passphrase"
stegoforge decode -f music_stego.wav -k "key" --method phase

# Run the complete heuristic gauntlet natively (Highly Recommended)
stegoforge ctf -f suspicious.png

# Targeted ML / Statistical Detection
stegoforge detect --chi2 -f image.png
stegoforge detect --rs -f image.png

# Embed a payload and securely POST it as a disguised HTTP packet
stegoforge deadrop post -c cover.png -p msg.txt -k "shared_key"

# Monitor a remote image URL for an incoming payload change
stegoforge deadrop monitor --url "https://example.com/image.png" -k "shared_key" --interval 20

Built by Nour833. Coded for the community.
If you find StegoForge useful, educational, or just plain cool, consider leaving a ⭐!

Report a Bug • Request a Feature