Deep dive into ancillary PNG chunks (tEXt, zTXt, iTXt, pHYs) and how attackers embed metadata, covert channels, and secondary data.
PNG chunks are split into critical chunks (IHDR, PLTE, IDAT, IEND) that every decoder must interpret, and ancillary chunks that can be ignored without preventing rendering.
Ancillary text chunks like tEXt and zTXt (zlib compressed) are prime locations for covert communication and flag exfiltration because image viewers never display their text on-screen.
Security Analyst and Aspiring Security Engineer passionate about digital image forensics, OSINT research, CTF steganography challenges, and client-side application security.
A complete step-by-step walkthrough on how CTF challenge authors hide flags by cropping IHDR height, and how to recover the original dimensions in milliseconds.
How to inspect and extract hidden payloads from PNG textual and physical metadata chunks during digital forensics investigations.