> For the complete documentation index, see [llms.txt](https://exploitminder.gitbook.io/blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://exploitminder.gitbook.io/blog/embed-and-export-tools.md).

# Embed and Export Tools

## Foremost

foremost is used to also to extract data

```jsx
foremost -e filename
```

or

```jsx
foremost e filename -T
```

***

## Bulkextractor

#### in order to find url or and text in dmp file just like we used in participation 4

1. unzip the .dmp file or any file
2. extract it using any extraction tool for example : bulkexractor

```jsx
Bulk_exractor newoutputfilename memorydumpname_or_anyfilename 
```

```jsx
cat filename  | grep "the given text " 
```

***

## Binwalk

Detect a hidden data + extract data:

```jsx
binwalk filename
```

```jsx
binwalk -e filename
```

⚠️ \*\*\*you can take the offset of the beginning of the file and extract it from hexeditor\*\*\*

***

## WinHex

🛠 in kali linux there is a tool just like HexEditior , Winhex named → bless hex editior

* WinHex & HxD are in windows
* You can use online tools like : [https://hexed.it](https://hexed.it/)

### Download cmd :

```jsx
sudo apt install bless
```

* we need to know file signatures in order to fix any file or to check them after opening the editior here is a list of filesignatures: <https://www.filesignatures.net/index.php?page=all>

#### Bit Shifting:

* WinHex also used for Bit Shifting using:

  1- open file

  2- modify data

  3- shift to left or right

  4- save it as another file named e.g:file2.txt reopen file2.txt then reverse shift left or right in order to get the data.

  5- after that check the hashes use tools→compute hashes

***

## Steghide

> this tool allows you to hide data text or image inside another to emebed and exract

1. embed data:

```jsx
steghide embed -cf downloadedImage.jpg -ef test.txt
```

* cf : sand fot current file
* ef : stand for embeded file

before extracting or after embeding **passphrase** is required in order to protect data most people use common wordlists like rockyou.txt or they make their own wordlist.

1. extract data:

```jsx
steghide extract -sf downloadedImage.jpg --> is used to extract hidden file
```

***

## Zsteg

> this tool allows you to detect hidden data in png & bmp

```jsx
zsteg [options] filename.png [param_string]
```

here is an example :

```jsx
zsteg flower_rgb3.png

imagedata           .. file: 370 XA sysV pure executable not stripped - version 768
b3,rgb,lsb,xy       .. text: "SuperSecretMessage"
```

***

## Stegseek

> this tool allows you to break the the **passphrase** using rockyou.txt or any wordlist

```jsx
stegseek downloadedImage.jpg wordlist.txt
```

Read the extracted file by typing :

```jsx
cat nameofimage.jpg.out
```

***

## Important notes:

### to embed data :

you may use the following command:

```jsx
copy /b coverfile + embeddedfile outputfile
```

You may also embed a file by copying the entire hexavalues and combine it with the hexavalues for another file

***

to create a new text document and write it:

```jsx
echo “hidden text maybe ” > text1.txt
```