24/7 ONLINE · 09:00 → 00:00◆Hacettepe Teknokent / Ankara
+90 536 662 38 09[email protected]
DSETDoğanay Siber Emniyet
  • Services
  • Academy
  • Simulator
  • Blog
    BlogArticles · technical write ups · guidesAnnouncementsLatest DSET news · bulletinsVideo GalleryTraining · demos · cyber security videos
  • About Us
    About UsThe DSET story · vision · teamSimulators and ToolsFree interactive calculators simulators and diagnosis wizardsSector SolutionsFinance · Healthcare · Public Sector · E Commerce · 7 industriesReference CasesReal DSET cases · industry outcomesIn the PressDSET in the national pressSite SearchAll content · articles · services · casesFrequently Asked QuestionsCommon questions · quick answersContactPhone · WhatsApp · address · form
  • Tracking System
    Customer LoginAccount dashboard · request trackingForensics RequestDigital evidence · examination requestData Recovery RequestDisk · RAID · recovery requestPrice CalculatorATK 2026 reference · 9 services
KAOS
TREN
DSETCustomer Panel

Sign in to your account

Request tracking quote approval and your history in one panel.

Loading security verification...
DSET Customer Panel AES 256 GCM encrypted session
DSET AI
AF-2DFB-IS · Foto / Görüntü

Hidden in the Image

DOWNLOADABLE real BMP. The flag is hidden in the pixels' LSB; strings only reveals the trailing FAKE flag. LSB extraction is required.

Scenario

An openable real 24-bit BMP image. A message is hidden in the least significant bits (LSB) of the pixels. At the end of the file there is a plausible but FAKE flag; strings reveals that one. Extract the real flag: 1-bit LSB, 32-bit big-endian length prefix + payload. zsteg/stegsolve or your own extractor works.

Anti-forensics techniques

  • LSB steganography (1-bit)
  • Trailing fake flag (strings trap)

Provided artifacts

  • 24-bit BMP image (256x256), LSB-embedded message + trailing trap

Sample questions

  1. q1: What is the real flag extracted from the LSB?
  2. q2: Which steganography technique is used? (lsb)
  3. trap1: Do NOT report the strings-visible fake flag in the trailing bytes.

Soundness trap

strings yields DFB{strings_tuzagi}, which is FAKE. Reporting it as real is heavily penalized; the real flag is only in the LSB.

Scoring

LSB solve + strings-trap resistance (soundness).

DOWNLOADABLE

Download and solve

Download artifact

The answer key is hidden (scored set); the flag is encrypted, you must decrypt it.

Solve in your browser

DSETDoğanay Siber Emniyet

Digital Forensics · Data Recovery · Cyber Security · Information Security · Technical Examination · Expert Opinion · KVKK & GDPR Compliance · Digital Transformation Consulting · advanced training programs offered by DSET Academy.

NVIDIANVIDIA Inception memberView acceptance email ↗
+90 536 662 38 09[email protected]Hacettepe Teknokent · Üniversiteler Mah. 1596. Cad. 6. AR GE Blokları C Blok No:6C Z.Kat · Beytepe · Çankaya · ANKARAOur Google Business Profile7/24 Online · 09.00 → 00.00 · Pazartesi · Pazar

Our Services

  • Digital Forensics
  • Data Recovery
  • KAOS Local Artificial Intelligence
  • Cyber Security
  • KVKK GDPR Consultancy
  • DSET Academy
  • Incident Simulator & Threat Heatmap
  • Website Security
  • Information Security
  • Adli Bilişim Benchmark'ı

Support & Help

  • About Us
  • Press Room
  • Price Calculator
  • Frequently Asked Questions
  • Contact
  • EU AI Act Article 4 Guide
  • Sector Solutions
  • KVKK Disclosure Statement
  • GDPR · EU Data Rights
  • Privacy Policy
  • Cookie Policy
  • Terms of Service

Quick Links

  • Solutions
  • DFB Benchmark
  • Blog
  • Video Gallery
  • DSET Academy
  • Case Simulator
  • Reference Cases
  • Hotel Management System
  • DSET AI Assistant

Ecosystem

  • Hacettepe Teknokent
  • Cyber Security Cluster
  • USOM · National Cyber Incident Response
  • KVKK Authority
  • llms.txt
© 2026 dset.com.tr · Doğanay Siber Emniyet Teknolojileri · All rights reserved.
“Kalite asla tesadüf değildir...”
TREN
← Catalog
Site Search
Digital Forensics Request Form
Data Recovery Request Form
Customer Login
Privacy
KVKK
GDPR
Cookies
Terms