ST3GG

     ███████╗████████╗██████╗  ██████╗  ██████╗
     ██╔════╝╚══██╔══╝╚════██╗██╔════╝ ██╔════╝
     ███████╗   ██║    █████╔╝██║  ███╗██║  ███╗
     ╚════██║   ██║    ╚═══██╗██║   ██║██║   ██║
     ███████║   ██║   ██████╔╝╚██████╔╝╚██████╔╝
     ╚══════╝   ╚═╝   ╚═════╝  ╚═════╝  ╚═════╝

       __                                    .--.
      /  '-.                               .'    '.
     / .-. |  ⊰ ev͏er͏y pi͏x͏el͏ ha͏s a͏ story͏ ⊱ /  .--.  \
    /.'   \|     you just can't see it    |  /    \  |
   //   |\  \                             | |      | |
  ||   | \  |    ⊰ LOVE PLINY ⊱          |  \    /  |
 /||   |  \ |                              \  '--'  /
/ ||__/   \/                                '.____..'

_{This image contains hidden data. Can you find it?}

⊰ What Is ST3GG? ⊱

STE.GG‍​‌​‌​​​​​‌​​‌‌​​​‌​​‌​​‌​‌​​‌‌‌​​‌​‌‌​​‌​​‌​​​​​​‌​​‌‌​​​‌​​‌‌‌‌​‌​‌​‌‌​​‌​​​‌​‌​‌​‌​​‌‌​​‌​​​​​​‌​‌‌​​‌​‌​​‌‌‌‌​‌​‌​‌​‌‍ is a feature-rich, open-source steganography toolkit that hides secret data inside images, audio, documents, network packets, and more — using 100+ encoding techniques across every file format imaginable.

It runs 100% in your browser (static site, no server) or as a Python CLI/TUI/WebUI. No data ever leaves your machine. Every technique that encodes also decodes. Every attack surface is also a detection surface.

⊰•-•✧ Some secrets are hidden in plain sight ✧•-•⊱

⊰ Why ST3GG? ⊱

⊰ The Big Picture: Offense & Defense ⊱

ST3GG is a dual-use toolkit — built for both sides of the steganography battlefield.

RED TEAM / Offense — Poisoning Simulations

Data exfiltration doesn't always look like data exfiltration. ST3GG lets red teams and researchers simulate every known data smuggling vector to test whether defenses actually catch them:

• 100+ encoding techniques across images, audio, text, documents, network packets, archives, and code files
• Polyglot file generation — files that are simultaneously valid as two formats (PNG+ZIP)
• Network protocol covert channels — data hidden in DNS queries, ICMP payloads, TCP sequence numbers, HTTP headers
• Unicode steganography — invisible homoglyphs, zero-width chars, variation selectors, confusable whitespace
• Compression-resistant encoding — F5 mode operates directly on JPEG coefficients (proven to survive social media); DCT mode designed for compression resistance
• Multi-layer nesting — up to 11 recursive layers of steganography (Matryoshka mode)
• Ghost Mode — AES-256 encryption + bit scrambling + noise decoys for maximum evasion

If your DLP can't catch it, you need to know that before the adversary does.

BLUE TEAM / Defense — ALLSIGHT Comprehensive Detection

The same toolkit that creates steganographic payloads also detects and decodes them. ST3GG's analysis engine provides full-spectrum visibility across all known data smuggling surfaces:

• 20+ detection functions — chi-square analysis, bit-plane entropy, histogram analysis, signature scanning, STEG header detection
• AI-powered exhaustive analysis — autonomous agent tests every decoding method for the uploaded file type
• File type identification — magic byte detection for 20+ formats (PNG, JPEG, GIF, BMP, WebP, TIFF, ICO, SVG, WAV, AIFF, AU, MIDI, PCAP, PDF, ZIP, GZip, TAR, SQLite, and more)
• Unicode steganography detection — zero-width chars, homoglyphs, variation selectors, combining marks, confusable whitespace, emoji patterns
• Whitespace analysis — trailing space/tab encoding, Unicode space variant detection
• Metadata forensics — base64/hex string extraction, EXIF analysis, PNG chunk inspection
• Network packet analysis — PCAP parsing for covert channel indicators
• 200+ automated tests verifying detection accuracy with zero false negatives on known techniques

See everything. Miss nothing. That's ALLSIGHT.

⊰•-•✧ The best defense starts with understanding the offense ✧•-•⊱

⊰ Who Is This For? ⊱

ST3GG isn't just a toy. Different communities use steganography tools for very different — and very real — reasons.

Penetration Testers & Red Teams

Simulate data exfiltration through steganographic channels during engagements. Test whether endpoint DLP, SIEM rules, and network monitoring catch covert data smuggling across 100+ vectors. Generate adversarial payloads across every file type to validate detection coverage.

Blue Teams & SOC Analysts

Use ALLSIGHT to scan suspicious files for hidden payloads. Run exhaustive analysis against every known encoding method. Build detection rules from the comprehensive example library. Train analysts on what steganographic artifacts look like in the wild.

CTF Players & Competitive Hackers

The ultimate steg toolkit for Capture The Flag competitions. Encode and decode across every channel/bit/strategy combination. Auto-detect unknown configurations with Smart Scan. Unwrap multi-layered Matryoshka challenges automatically.

Digital Forensics & Incident Response

Analyze seized media for steganographic communication channels. Detect hidden data in image attachments, document metadata, audio files, and network captures. Identify which encoding technique was used and extract the hidden payload.

Privacy Researchers & Journalists

Explore steganography as a privacy-preserving communication channel. Understand the trade-offs between capacity, stealth, and compression survival. Test which techniques survive social media re-encoding for real-world deniable communication.