System Hacking - p.12

Lab 11

Hiding Data Using Snow Steganog raphy

Lab Scenario

Network steganography describes all the methods used tor transmitting data over a network without it being detected. Several methods for liiduig data ina network have been proposed, but the main drawback of most of them is that they do not offer a secondary layer of protection. If steganography is detected, the data is in plaintext. To be an expert ethical hacker and penetration tester, you must have sound knowledge of footprinting, scanning, and enumeration. Tins process requires an active connection to the machine being attacked.

Lab Objectives

The objective of this lab is to help students learn:
■ Using Snow steganography to hide tiles and data
■ Hiding tiles using spaces and tabs

Lab Environment

To earn־ out die lab, you need:

■Snow located at D:\CEH-Tools\CEHv8 Module 05 System Hacking\Steganography\Whitespace Steganography\SNOW
■Run tins tool on Windows Server 2012
■ You can also download the latest version of Snow from the link http :/Avww.darks1de.com.au/snow/
■ If you decide to download the latest version, then screenshots shown in the lab might ditter

Lab Duration

Tune: 10 Minutes

Overview of Snow

Snow exploits die steganograplnc nature of whitespace. Locating trailing whitespace in text is like tinduig a polar bear 111 a snowstorm. It uses die ICE encryption algoridun, so the name is diemadcally consistent.

Lab Task

1. Open a command prompt and navigate to D:\CEH-Tool\CEHv8 module 05 system hacking\steganography\white space steganography\snow
2. Open Notepad and type Hello World! and dien press enter and press die Hyphen key to draw a line below it.
3. Save die die as readme.txt.

FIGURE 11.1: Contents of readme.txt

4. Type diis command 111 the command sheU: readme2.txt. It is die name of anodier diat will be created automatically.
snow -C -m "My sw iss bank account number is 45656684512263”
p "magic" readme.txt readme2.txt(magic is the password, you can
type your desired password also)

FIGURE 11.2: Hiding Contents of readme, txt and die text in the readme2.txt file

5. Now die data (‘ My Swiss bank account number is 45656684512263 ”) is hidden inside die readme2.txt hie with die contents of readme.txt.
6. The contents ol readme2.txt are readme.txt + My Swiss bank account number is 45656684512263.
7. Now type snow -C -p "magic" Readme2.txt: diis will show die contents of readme.txt.(magic is die password which was entered while luding die data).

FIGURE 11.3: Revealing the hidden data of readme2.txt

8. To check die tile in a G U I, open die readme2.txt in Notepad and select Edit־^ Select all. You will see die hidden data inside readme2.txt inthe form of spaces and tabs.

FIGURE11.4: Contents of readme2.txt revealed with select all option

Lab Analysis
Analyze and document die results related to die lab exercise.

Lab Questions
1. How would you lude die data of tiles widi secret data in other tiles?
2. Which encryption is used 111 Snow?