Image Steganography on Kali Linux: Hide Messages with Steghide

Image steganography lets you ship a secret inside an ordinary photo. In an ethical hacking lab you practice embed and extract workflows before defenders hunt the same artifacts with forensics tooling.

This guide walks through steghide on the command line (primary), Stegosuite on Kali desktop or CLI for PNG, and a short note on OpenStego for readers who want a Java GUI on other platforms. Every steghide command and output below was captured on Kali Rolling 2026.2.

What is image steganography in ethical hacking?

Steganography hides a payload inside a carrier file. Cryptography protects content; steganography hides the fact that a second message exists. Attackers have used image stego in phishing attachments and forum posts; defenders look for size anomalies, statistical tests, and known tool signatures.

In a lab you typically:

• Pick a cover image (JPEG or PNG)
• Write a short secret file or message
• Embed with a passphrase or AES key
• Share only the stego image
• Recover the payload with the same tool and secret

That differs from EXIF metadata parsing, which reads camera fields already stored in the file header. Steganography adds or manipulates payload bytes inside the image container. Forensic teams may still detect it during disk or memory analysis when file sizes or entropy shift.

Compare steganography tools

Kali ships CLI and GUI options. Pick based on format support and whether you need a terminal-only workflow.

This article tests steghide end to end on JPEG, then Stegosuite on PNG. OpenStego follows the same mental model—cover file, secret, passphrase, output stego file—but installs from the OpenStego GitHub releases page when you need it outside Kali packages.

Kali lab setup

Create one workspace with a cover image and a text payload. You reuse the same paths for embed, info, and extract steps.

Set lab variables once:

STEG_LAB="${HOME}/steg-lab"
COVER="${STEG_LAB}/cover.jpg"
SECRET="${STEG_LAB}/secret.txt"
STEGO="${STEG_LAB}/cover-stego.jpg"
STEG_PASS='LabSteg2026!'

mkdir -p "${STEG_LAB}"

Build a simple JPEG cover with ImageMagick so you do not depend on an external download:

convert -size 400x300 xc:'#4a90d9' -fill white -pointsize 24 -gravity center -annotate 0 'Steganography lab cover' "${COVER}"

Write the message you will hide:

printf '%s\n' 'GoLinuxCloud steganography lab message — authorized test only.' > "${SECRET}"

Confirm the lab files exist:

ls -lh "${STEG_LAB}/"

Sample output:

total 12K
-rw-r--r-- 1 kali kali 8.0K ... cover.jpg
-rw-r--r-- 1 kali kali   65 ... secret.txt

An 8 KB JPEG with a 65-byte text file is enough to exercise capacity checks and passphrase-protected embed on Kali.

Install steghide and Stegosuite on Kali

Both tools are in Kali repositories. ImageMagick is optional but useful for generating lab covers. Install them with apt command.

sudo apt update

sudo apt install -y steghide stegosuite imagemagick

Verify package versions:

dpkg-query -W -f='${Package} ${Version}\n' steghide stegosuite imagemagick

Sample output:

imagemagick 8:7.1.2.27+dfsg1-1
steghide 0.5.1+git20240220-2
stegosuite 0.9.0-1

steghide --version

Sample output:

steghide version 0.6.0

The binary reports 0.6.0 while the Debian package tracks the git snapshot above—both refer to the same Kali build.

Embed a secret message with steghide

steghide compresses and encrypts the payload, then writes a new stego file. Pass the passphrase on the command line in the lab so the walkthrough is non-interactive; on your own machine you can omit -p and type it at the prompt.

steghide embed -cf "${COVER}" -ef "${SECRET}" -sf "${STEGO}" -p "${STEG_PASS}" -f

Sample output:

embedding "/home/kali/steg-lab/secret.txt" in "/home/kali/steg-lab/cover.jpg"... done
writing stego file "/home/kali/steg-lab/cover-stego.jpg"... done

Compare file sizes—the stego copy is slightly larger even though both images look the same in a viewer:

ls -lh "${COVER}" "${STEGO}"

Sample output:

-rw-r--r-- 1 kali kali 8.0K ... /home/kali/steg-lab/cover.jpg
-rw-r--r-- 1 kali kali 9.7K ... /home/kali/steg-lab/cover-stego.jpg

That size delta is a common defender signal. In a report, note both the visual similarity and the byte growth.

Inspect stego files with steghide info

steghide info reports format, remaining capacity, and embedded file metadata when data is present. Supply the passphrase with -p on stego files so the command does not hang on an interactive prompt.

steghide info "${STEGO}" -p "${STEG_PASS}"

Sample output:

"cover-stego.jpg":
  format: jpeg
  capacity: 542.0 Byte
  embedded file "secret.txt":
    size: 65.0 Byte
    encrypted: rijndael-128, cbc
    compressed: yes

The embedded name secret.txt, encryption algorithm, and compressed flag are the fields you paste into lab notes. List supported ciphers when you need to document alternatives:

steghide encinfo | head -8

Sample output:

encryption algorithms:
<algorithm>: <supported modes>...
cast-128: cbc cfb ctr ecb ncfb nofb ofb
gost: cbc cfb ctr ecb ncfb nofb ofb
rijndael-128: cbc cfb ctr ecb ncfb nofb ofb
twofish: cbc cfb ctr ecb ncfb nofb ofb
arcfour: stream
cast-256: cbc cfb ctr ecb ncfb nofb ofb

Default embed uses Rijndael-128 CBC unless you pass -e none to skip encryption (not recommended for real secrets).

Extract hidden data with steghide

The recipient needs the stego file and the same passphrase. steghide writes the recovered payload to -xf.

steghide extract -sf "${STEGO}" -xf "${STEG_LAB}/recovered.txt" -p "${STEG_PASS}" -f

Sample output:

wrote extracted data to "/home/kali/steg-lab/recovered.txt".

cat "${STEG_LAB}/recovered.txt"

Sample output:

GoLinuxCloud steganography lab message — authorized test only.

A matching line confirms embed and extract succeeded. Test a wrong passphrase to see the failure mode defenders log during brute-force attempts:

steghide extract -sf "${STEGO}" -xf "${STEG_LAB}/bad.txt" -p 'wrongpass' -f

Sample output:

steghide: could not extract any data with that passphrase!

Record that error when analysts test leaked stego images with a wordlist.

Hide messages with Stegosuite on Kali

Stegosuite bundles a Swing GUI and subcommands for embed, extract, and capacity. On a Kali desktop session, launch the GUI:

stegosuite gui

Drag your cover image into the window, enter a text message and secret key, then click Embed. The tool writes a new image beside the original. Extraction uses the same key on the stego file through the GUI Extract tab.

For terminal-only labs, PNG covers embed cleanly without a display server. JPG embedding in Stegosuite 0.9 expects AWT display support on Kali—use steghide for JPEG or run Stegosuite GUI on a desktop Kali VM.

Create a PNG cover and embed a short message from the CLI:

PNG_COVER="${STEG_LAB}/cover.png"
PNG_STEGO="${STEG_LAB}/cover-stegosuite.png"
convert -size 400x300 xc:'#2d6a4f' -fill white -pointsize 24 -gravity center -annotate 0 'PNG steg lab' "${PNG_COVER}"

stegosuite embed -k "${STEG_PASS}" -m 'Stegosuite CLI lab message — authorized test.' -o "${PNG_STEGO}" "${PNG_COVER}"

Sample output:

Loading png image from /home/kali/steg-lab/cover.png
Embedding data...
Saving png image to /home/kali/steg-lab/cover-stegosuite.png

Check how much data the PNG can hold before you embed larger files:

stegosuite capacity "${PNG_COVER}"

Sample output:

Loading png image from /home/kali/steg-lab/cover.png
Capacity: 501 B

The capacity line tells you how much text or file data the PNG can absorb before embed fails. Use the GUI to extract PNG payloads when CLI extract hits display limitations on your session—the embed step above already proves Stegosuite accepts the same key and message format on Kali packages.

OpenStego as a cross-platform option

OpenStego is a Java GUI steganography tool for Linux, macOS, and Windows. The workflow mirrors Stegosuite: choose a secret file or message, pick a cover image, set a password, and generate an output stego file. Extraction asks for the stego file and password and restores the hidden payload.

Kali does not ship OpenStego in the default repos this refresh used, so install it from the official GitHub release when you need that UI on a non-Kali workstation. For Kali-only labs, steghide plus Stegosuite cover the same learning goals without a separate installer.

Steganography troubleshooting

References

• steghide project
• Stegosuite
• OpenStego on GitHub
• ImageMagick

Summary

You set up a steg-lab workspace on Kali, installed steghide and Stegosuite, and hid a text file inside a JPEG using steghide embed with Rijndael-128 encryption. steghide info showed embedded filename, size, and cipher details, and steghide extract recovered the original message when the passphrase matched.

Stego files often grow by a few kilobytes even when viewers see no visual change—that byte delta matters for blue teams. Stegosuite adds a GUI path and CLI embed for PNG on the same host; OpenStego remains a sensible cross-platform alternative when you are not on Kali packages.

Treat steganography as concealing presence, not invincibility. Pair embed and extract practice with the EXIF and forensic imaging workflows covered earlier in this guide. Optional compression with tar before embed can shrink payloads when capacity is tight.