adding more features inclided steg analysis, decoding engines, and more

tests
This commit is contained in:
venus
2026-07-19 00:13:13 -05:00
parent c48e4343dc
commit cd7ef151c4
20 changed files with 1360 additions and 48 deletions

View File

@@ -51,6 +51,8 @@ Houses the logic for generic CLI context and active competition commands:
### D. Forensics ([forensics.py](file:///home/venus/code/ctf/src/ctf/forensics.py))
Implements specialized forensic inspection utilities registered as a nested subgroup under the CLI:
* **Custom Extractor**: Implements our own pure-Python, zero-dependency parser for standard TIFF/EXIF tags, Adobe XMP XML blocks, Photoshop IPTC IIM records, and JPEG/PNG physical parameters, rather than importing large external libraries.
> [!NOTE]
> We designed and implemented our own custom EXIF scraper/parser from scratch in pure Python rather than importing an external library (like `exifread` or `Pillow`) to maintain zero dependencies and keep the toolchain highly lightweight and customizable.
* `info`: Inspects target file sizes, reads magic bytes, and warns if extensions do not match detected signatures.
* `flag-search`: Extracts printable string sequences (equivalent to GNU `strings`) and matches them against regular expression patterns to find potential flags.
@@ -75,6 +77,7 @@ Implements specialized forensic inspection utilities registered as a nested subg
### A. Forensics Pipeline & Extended Metadata
* **Pipeline Coordination**: A central runner that coordinates file inspections, signature verification, and string searches sequentially on target files.
* **Carving & Extraction Toolkit**: Deep inspection and carving utilities (such as archive extracting, custom chunk/payload carvers, and EXIF/metadata header decoders).
* **Chepy Machine Learning**: Plan to integrate the `chepy_ml` plugin later to perform automated heuristics, entropy analysis, and machine-learning-based format detection on unknown metadata payloads.
* **Targeted Forensic Metadata Parsing**: Implement decoders/parsers for high-signal forensics structures:
* *PNG*: `tEXt`, `zTXt`, `iTXt` metadata chunks.
* *PDF*: `/Info` dictionaries and `/Metadata` XML streams.