White Envelope

Platform: hackerlab | Category: Steganography | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-23 | Status: Solved Techniques: stegsnow extraction, Trailing whitespace analysis, Whitespace steganography detection

Summary

Task: Text file with a romantic story containing hidden data. Solution: Used stegsnow to extract flag from trailing whitespace (tabs and spaces encoding).

White Envelope — hackerlab.pro

Description

Сегодня было особенно снежное и морозное утро. Я проснулся, выпил кофе и решил проверить почту. К моему удивлению, там лежал белый конверт. Отправитель указан не был.

Files: task.zip → task.txt (text file with a romantic story)

Analysis

1. Hints in the description

The description contains key hint words:

• "снежное" (snowy) → snow → stegsnow
• "белый конверт" (white envelope) → whitespace (white = spaces)

These are classic hints pointing to whitespace steganography. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

2. File analysis

 bash read-only • copy allowed Copy
# Check the file
file task.txt
# task.txt: UTF-8 Unicode text

# View hex dump
xxd task.txt | head -50

The hex dump revealed:

• Normal text with a romantic story about a winter evening
• Lines between paragraphs consisting only of spaces (0x20) and tabs (0x09)
• Trailing whitespace at the end of many lines

3. Whitespace pattern

 bash read-only • copy allowed Copy
# Find lines with trailing whitespace
cat -A task.txt | grep -E '[\t ]+\$'

Characteristic patterns of spaces and tabs are visible — this is stegsnow encoding. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

stegsnow

stegsnow is a utility for hiding data in trailing whitespace of text files. It uses combinations of spaces and tabs to encode bits.

 bash read-only • copy allowed Copy
# Installation (if not present)
# apt install stegsnow  # Debian/Ubuntu
# brew install stegsnow # macOS

# Extraction without password
stegsnow -C task.txt

Result:

CODEBY{REDACTED}

Alternative method (manual analysis)

 python read-only • copy allowed Copy
#!/usr/bin/env python3
# If stegsnow is not available

with open('task.txt', 'r') as f:
    content = f.read()
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Extract trailing whitespace from each line
bits = []
for line in content.split('\n'):
    # Find trailing whitespace
    stripped = line.rstrip()
    trailing = line[len(stripped):]
    
    # Decode: space=0, tab=1 (simplified)
    for char in trailing:
        if char == ' ':
            bits.append('0')
        elif char == '\t':
            bits.append('1')

# Convert bits to bytes
# (actual stegsnow uses a more complex scheme)

Tools

stegsnow

 bash read-only • copy allowed Copy
# Extraction (without password)
stegsnow -C file.txt
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Extraction (with password)
stegsnow -C -p "password" file.txt

# Hiding data
stegsnow -C -m "secret message" -p "password" cover.txt stego.txt

Manual verification

 bash read-only • copy allowed Copy
# Show invisible characters
cat -A file.txt

# Hex dump for analysis
xxd file.txt | grep -E '09|20'

# Count trailing whitespace
grep -c '[[:space:]]$' file.txt

Related Techniques

• Zero-width steganography — Unicode invisible characters (U+200B, U+200C, U+200D)
• snow (SNOW) — alternative whitespace stego implementation
• Whitespace programming language — esoteric language using spaces/tabs ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

References

• stegsnow manual
• Whitespace Steganography ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍