Stegseek is a lightning-fast steghide password cracker that can extract hidden data from files by brute-forcing millions of passwords per second.
:zap: Worlds fastest steghide cracker, chewing through millions of passwords per second :zap:
Stegseek is primarily used by security researchers, penetration testers, and forensic analysts to quickly recover hidden data embedded with steghide by cracking passwords from large wordlists. It also aids in detecting steghide content and extracting unencrypted metadata without needing a password, making it valuable for vulnerability assessments and CTF challenges.
Building Stegseek natively on Windows is not supported; users should run it via WSL for best compatibility. The tool exploits a known vulnerability (CVE-2021-27211) to extract unencrypted metadata, so it is useful for testing steghide implementations. Use large, comprehensive wordlists like rockyou.txt to maximize password cracking success.
Download the latest Stegseek release from the GitHub releases page
On Debian-based Linux systems, install the .deb package using: sudo apt install ./stegseek_0.6-1.deb
For other Linux systems, build from source following instructions in BUILD.md
On Windows, install and configure WSL with an Ubuntu distribution
Within WSL, install Stegseek using the Linux installation instructions
Alternatively, run Stegseek using the provided Docker containerstegseek [stegofile.jpg] [wordlist.txt]
Cracks the steghide password by trying all passwords in the provided wordlist against the stegofile.
stegseek --seed [stegofile.jpg]
Detects if a file contains steghide data and attempts to extract unencrypted metadata and embedded files without a password.
stegseek --help
Displays the full list of available options and usage instructions.
stegseek --crack [stegofile.jpg] [wordlist.txt] [output.txt]
Cracks the steghide password using the specified wordlist and saves the extracted data to output.txt.
stegseek --seed [stegofile.jpg] [output.txt]
Attempts to recover unencrypted embedded data from the stegofile and saves it to output.txt.