How to inspect and extract hidden payloads from PNG textual and physical metadata chunks during digital forensics investigations.
zTXt chunks store compressed keyword/text pairs using zlib deflate. Malware authors and CTF creators compress scripts or base64 keys into zTXt blocks.
Extracting raw chunk slices allows analysts to decompress payloads without executing untrusted scripts.
Security Analyst and Aspiring Security Engineer passionate about digital image forensics, OSINT research, CTF steganography challenges, and client-side application security.
A complete step-by-step walkthrough on how CTF challenge authors hide flags by cropping IHDR height, and how to recover the original dimensions in milliseconds.
Deep dive into ancillary PNG chunks (tEXt, zTXt, iTXt, pHYs) and how attackers embed metadata, covert channels, and secondary data.