S3 · Steganography — An image can hide text

The file /hunt/challenge-3.png is an explicit exercise: it contains a payload hidden by steganography. (The gift wallpaper /hunt/onsecret-lock.png is clean — we won’t train you to carry booby-trapped images on your daily device.)

Download the challenge file and extract the payload with steghide, using the passphrase S2 gave you. The payload contains the S3 token.

Honest note: steghide has been unmaintained since 2003. We use it here because it is simple and instructive — not as a tool you should rely on to protect yourself.

Run this:

curl -sO https://onsecret.net/hunt/challenge-3.png
# detect: steghide info challenge-3.png   (or: binwalk / zsteg)
steghide extract -sf challenge-3.png -p <S2-passphrase>
cat *.txt

⇩ /hunt/challenge-3.png(labelled challenge)