Shiba Insider

Overview

A steganography-focused challenge combining PCAP analysis, credential extraction, and hidden data recovery. The investigation follows a chain: decode credentials from HTTP traffic → crack a ZIP → extract metadata from an image → retrieve a hidden payload using steghide → identify the attacker via their BTLO profile.

PCAP Analysis

Opening the PCAP in Wireshark reveals a small capture containing a single HTTP GET request. Following the HTTP stream shows the server response:

use your own password

Inspecting the request headers more closely reveals a Base64-encoded Authorization header — standard HTTP Basic Auth format. Decoding it:

echo "base64string" | base64 -d

Returns the credentials: fakeblue:redforever

ZIP Extraction

Using redforever as the ZIP password extracts the archive contents — an image file and a README. The README confirms no further passwords are needed for the remainder of the challenge.

Metadata Analysis — Exiftool

Running Exiftool against the extracted image reveals embedded metadata:

bash

exiftool image.jpg

Among the standard fields, one stands out:

Technique: Steganography

This is a direct hint — data has been hidden inside the image file itself.

Steganography Extraction — Steghide

With steganography confirmed via the metadata, steghide is the appropriate extraction tool:

bash

steghide extract -sf image.jpg

The hidden payload is extracted, revealing an ID string: 0726ba878ea47de571777a

Attacker Identification

The challenge name “Insider” is the key — this ID corresponds to a BTLO user profile. Searching the ID on the BTLO platform identifies the attacker’s profile as bluetiger.