# Zanzibar Whisper

The hidden file was encrypted, with an empty passphrase. The lab had the flag in under half a minute.

HI Cyber Con CTF 2026. Steganography. Published 2 November 2026. Challenge by archnexus707.

## The brief

> A mysterious image from the shores of Zanzibar has surfaced. Locals say it carries a hidden message, a whisper from the Spice Island. Can you uncover its secret?

- zanzibar-whisper.zip, 141 KB

## In short

A single JPEG from Zanzibar carried a steghide payload. The payload was encrypted, but its passphrase was empty, so the flag came out in under half a minute.

## A photo with a clean surface

The zip holds one JPEG, 1024 by 683 pixels. It has no metadata beyond a plain JFIF header, no comment, and nothing after the end of image marker. Whatever is hidden sits inside the image data.

## Three ways to hide data in a JPEG

The lab checked the three common schemes in one pass. One reads a hidden length of 57,782 bytes where only 18,851 fit, so it holds nothing. One finds no data at all. Steghide, asked with an empty passphrase, answers.

## Encrypted, with nothing as the key

Steghide spreads data over the image's compressed coefficients and encrypts it with a key made from the passphrase. Here there is room for 6.4 KB and one 28 byte file, Rijndael 128 in CBC mode, compressed. The key was made from nothing.

## Flag out in under half a minute

Extracting wrote zanzibar_flag2.txt, 28 bytes, the flag and a line break. A second extraction gave the same bytes. The whole solve took under half a minute.

## The insight

Encryption is only as strong as its passphrase. An empty one makes the cipher decoration, because anyone who asks with nothing gets everything.

## The flag

hiCTF{sp1c3_1sl4nd_s3cr3ts}

## More from this benchmark

[HI Cyber Con CTF 2026](https://p4ndora.ai/benchmarks/hi-cyber-con-2026)
[All benchmarks](https://p4ndora.ai/benchmarks)