Phantom Text
Today, the guys from @hackerdna bring to us a stego challenge, but in this case is base on unicode stego, you can try here, https://hackerdna.com/labs/phantom-text
So, first not going to explain what’s stego, but.. what’s Unicode stego?
Unicode steganography is a technique that hides data within text by using invisible or zero-width Unicode characters. These characters are part of the Unicode standard but are not rendered visually, making them perfect for concealing information in plain sight.
Get Malekith’s stories in your inbox
Join Medium for free to get updates from this writer.
Common Invisible Characters Used:
- Zero Width Space (U+200B): Originally used for line-breaking opportunities
- Zero Width Non-Joiner (U+200C): Used to control ligature formation
- Zero Width Joiner (U+200D): Used to join characters in complex scripts
- Left-to-Right Mark (U+200E) / Right-to-Left Mark (U+200F): Used for bidirectional text
This steganography method is effective because:
- It’s visually undetectable
- It survives copy-paste operations
- It can be embedded in any text format (HTML, TXT, emails, etc.)
In This Challenge:
The HTML file contained 288 invisible characters (158 × U+200B and 130 × U+200C) embedded after the word “Welcome”. These characters encoded a 288-bit binary string (36 bytes), which when decoded using the mapping U+200B = 0 and U+200C = 1, revealed the UUID flag.
So, how we can read the flag? the quickest way to use an online tool like: https://stegzero.com/
We can simply just copy — paste and the flag will be revealed
Or we also can script it..
You can choose the way you want :)
