Encoding ladder, audio spectrogram, stego, and nested archive
Foundations crypto/stego engagement: multi-encoding decode chain, spectrogram plaintext, image stego, and nested archive inspection recovered hidden strings.
Operator decoded leetspeak, binary, base32/64, hex, ROT13, ROT47, Morse, BCD, and nested base64; spectrogram and stego completed the media track; archive nesting hid AHH_YOU_FOUND_ME!.
CyberChef-style transforms recovered each plaintext sample.
Audio spectrogram, image stego, and archive walk recovered the final strings.
Engagement summary
Operator decoded leetspeak, binary, base32/64, hex, ROT13, ROT47, Morse, BCD, and nested base64; spectrogram and stego completed the media track; archive nesting hid AHH_YOU_FOUND_ME!.
C4PTUR3-TH3-FL4G was a structured encoding and media lab. Phase one recovered plaintext from leetspeak, binary, Base32, Base64, hex, ROT13, ROT47, Morse, BCD, and a long nested Base64 blob. Phase two opened an audio spectrogram reading Super Secret Message. Phase three extracted SpaghettiSteg from an image. Phase four unpacked a nested archive whose first member was hackerchat.png and whose deeper inspection yielded AHH_YOU_FOUND_ME!.
Business impact
Encoding is not encryption — analysts must recognize common transforms in malware and exfil. Spectrogram and stego checks belong in media triage. Nested archives are a standard smuggling path for phishing attachments.
Encoding and cipher ladder
CyberChef-style transforms recovered each plaintext sample.
OPERATOR · DECODE
savvy@lab:~$ echo 'c4n y0u c4p7u23 7h3 f149?' | # leetspeak →
can you capture the flag?
savvy@lab:~$ echo '01101100 01100101 ...' | tr -d ' ' | perl -lpe '$_=pack"B*",$_'
lets try some binary out!
savvy@lab:~$ echo MJQXGZJTGIQGS4ZAON2XAZLSEBRW63LNN5XCA2LOEBBVIRRHOM====== | base32 -d
base32 is super common in CTF's
savvy@lab:~$ echo Ebgngr zr 13 cynprf! | tr 'A-Za-z' 'N-ZA-Mn-za-m'
Rotate me 13 places!
Spectrogram, stego, and nested archive
Audio spectrogram, image stego, and archive walk recovered the final strings.
OPERATOR · MEDIA
savvy@lab:~$ # open WAV in Audacity → Spectrogram
Super Secret Message
savvy@lab:~$ steghide extract -sf image.jpg -p '' || zsteg image.png
SpaghettiSteg
savvy@lab:~$ binwalk -e mystery.bin && file */hackerchat.png
hackerchat.png → nested data → AHH_YOU_FOUND_ME!
Remediation
Train analysts on encoding recognition. Sandbox archive extraction; scan stego-capable formats in mail gateways when policy requires.