adding more features inclided steg analysis, decoding engines, and more
tests
This commit is contained in:
@@ -51,6 +51,8 @@ Houses the logic for generic CLI context and active competition commands:
|
||||
### D. Forensics ([forensics.py](file:///home/venus/code/ctf/src/ctf/forensics.py))
|
||||
Implements specialized forensic inspection utilities registered as a nested subgroup under the CLI:
|
||||
* **Custom Extractor**: Implements our own pure-Python, zero-dependency parser for standard TIFF/EXIF tags, Adobe XMP XML blocks, Photoshop IPTC IIM records, and JPEG/PNG physical parameters, rather than importing large external libraries.
|
||||
> [!NOTE]
|
||||
> We designed and implemented our own custom EXIF scraper/parser from scratch in pure Python rather than importing an external library (like `exifread` or `Pillow`) to maintain zero dependencies and keep the toolchain highly lightweight and customizable.
|
||||
* `info`: Inspects target file sizes, reads magic bytes, and warns if extensions do not match detected signatures.
|
||||
* `flag-search`: Extracts printable string sequences (equivalent to GNU `strings`) and matches them against regular expression patterns to find potential flags.
|
||||
|
||||
@@ -75,6 +77,7 @@ Implements specialized forensic inspection utilities registered as a nested subg
|
||||
### A. Forensics Pipeline & Extended Metadata
|
||||
* **Pipeline Coordination**: A central runner that coordinates file inspections, signature verification, and string searches sequentially on target files.
|
||||
* **Carving & Extraction Toolkit**: Deep inspection and carving utilities (such as archive extracting, custom chunk/payload carvers, and EXIF/metadata header decoders).
|
||||
* **Chepy Machine Learning**: Plan to integrate the `chepy_ml` plugin later to perform automated heuristics, entropy analysis, and machine-learning-based format detection on unknown metadata payloads.
|
||||
* **Targeted Forensic Metadata Parsing**: Implement decoders/parsers for high-signal forensics structures:
|
||||
* *PNG*: `tEXt`, `zTXt`, `iTXt` metadata chunks.
|
||||
* *PDF*: `/Info` dictionaries and `/Metadata` XML streams.
|
||||
|
||||
Reference in New Issue
Block a user