Подпись (Signature)

Platform: hackerlab | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-23 | Status: Solved Techniques: Binary encoding with tabs and spaces, Hex dump analysis for invisible characters, Whitespace steganography detection

Summary

Task: Text file with hidden whitespace characters after visible content. Solution: Decode tabs as 1 and spaces as 0 to extract binary-encoded ASCII flag.

Подпись (Signature) — hackerlab.pro

Description

Уже всё готово, поставь лишь подпись (Everything is ready, just put your signature)

Analysis

The challenge provides a ZIP archive with a file act.txt — a Russian "Acceptance Certificate" with signature fields (underscores).

Initial Analysis

1. The file looks like a regular text document with signatures
2. Hex dump reveals hidden whitespace characters after the visible text
3. This is classic Whitespace Steganography

Detecting Hidden Data

 bash read-only • copy allowed Copy
xxd act.txt | tail -50

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The hex dump shows lines consisting only of spaces (0x20) and tabs (0x09):

00000xxx: 20 20 20 20 09 20 20 20 20 20 20 09 09 0a  ...

Solution

Encoding Principle

• Each whitespace-only line encodes one ASCII character in binary
• Space (0x20) = 0
• Tab (0x09) = 1
• Lines with a single tab serve as separators between characters

Decoding Examples

Solution Script

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Whitespace Steganography Decoder
Decodes hidden message from tabs (1) and spaces (0) in text file
"""

with open('act.txt', 'r') as f:
    lines = f.readlines()

# Find whitespace-only lines (after visible document content)
ws_lines = []
for line in lines:
    stripped = line.rstrip('\n')
    if stripped and all(c in ' \t' for c in stripped):
        ws_lines.append(stripped)

# Decode each line as binary character
result = ''
for line in ws_lines:
    binary = ''
    for c in line:
        if c == ' ':
            binary += '0'
        elif c == '\t':
            binary += '1'
    
    # Skip separator lines (single tab = just "1")
    if binary and len(binary) > 1:
        char_code = int(binary, 2)
        if char_code > 0:
            result += chr(char_code)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

print(result)

Result

CODEBY{REDACTED}

Differences from Other Whitespace Techniques

Tools Used

• xxd / hexdump — hex dump analysis
• file — file type detection
• Python 3 — whitespace decoding ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍