1 00:00:01,110 --> 00:00:03,120 Let's talk about steganography. 2 00:00:03,150 --> 00:00:05,070 So what is techno graffiti? 3 00:00:05,250 --> 00:00:11,840 In simple terms, hiding a data behind another data is called steganography. 4 00:00:11,850 --> 00:00:20,950 For example, hiding text behind another text or hiding image behind another image or hiding text behind 5 00:00:20,950 --> 00:00:23,880 the image or hiding image behind video. 6 00:00:24,660 --> 00:00:28,110 Also, we can hide executable files behind the image. 7 00:00:28,110 --> 00:00:30,390 So let's see how to do that. 8 00:00:30,540 --> 00:00:31,170 Right. 9 00:00:32,160 --> 00:00:42,750 So we will start with hiding files using NTFS stream and what is it is a stream consist of a data associated 10 00:00:42,750 --> 00:00:45,000 with a main file or directory. 11 00:00:45,330 --> 00:00:45,960 Right. 12 00:00:46,380 --> 00:00:57,240 So in this article we are going to hide calculator file c executable file which is for calculator and 13 00:00:57,240 --> 00:00:59,970 we will going to hide this behind our text file. 14 00:01:00,360 --> 00:01:00,930 Right. 15 00:01:00,930 --> 00:01:07,660 So in real world you can replace calculator by your backdoor or by Trojan. 16 00:01:07,680 --> 00:01:08,250 Right. 17 00:01:08,250 --> 00:01:16,560 So when someone opens a text file, it won't know that behind this text file there is another Trojan 18 00:01:16,560 --> 00:01:17,220 or backdoor. 19 00:01:17,700 --> 00:01:20,790 But in the background that draws and will execute. 20 00:01:21,150 --> 00:01:21,750 Right. 21 00:01:22,110 --> 00:01:24,480 But the user is not able to see it. 22 00:01:26,310 --> 00:01:30,960 So first of all, you have to follow these steps separated by comma. 23 00:01:31,440 --> 00:01:32,030 Right. 24 00:01:32,040 --> 00:01:34,740 So first of all, let's open command prompt. 25 00:01:35,100 --> 00:01:39,840 So cmd run is admin. 26 00:01:42,480 --> 00:01:46,260 Now navigate to c drive. 27 00:01:48,600 --> 00:01:51,750 So the next step is to create a folder named Magic. 28 00:01:52,260 --> 00:01:55,650 So the Magic enter. 29 00:01:57,000 --> 00:02:07,050 Now the next step is to open a notepad and create a file called Read Me and type Helloworld in it. 30 00:02:07,680 --> 00:02:09,120 So notepad 31 00:02:11,700 --> 00:02:14,040 type hello world. 32 00:02:20,460 --> 00:02:21,420 Right now. 33 00:02:21,420 --> 00:02:24,750 Save this file into a magic folder. 34 00:02:26,900 --> 00:02:29,200 Save it. 35 00:02:29,660 --> 00:02:30,410 Give it a name. 36 00:02:30,440 --> 00:02:31,220 Read me. 37 00:02:36,860 --> 00:02:37,550 Now. 38 00:02:40,740 --> 00:02:45,090 Press the air to list all the directories. 39 00:02:46,950 --> 00:02:52,560 First of all, let's navigate to magic folder and now type dear. 40 00:02:52,770 --> 00:02:58,830 See, here is the file we have recently created and its size is 13 bytes. 41 00:02:58,830 --> 00:03:00,270 Remember this size? 42 00:03:01,620 --> 00:03:08,670 Now the next step is to copy calculator to magic folder. 43 00:03:08,970 --> 00:03:09,580 Okay. 44 00:03:09,780 --> 00:03:15,840 So the executable file for calculator is Kelcy dot xy. 45 00:03:16,980 --> 00:03:19,440 So there are two ways to do this. 46 00:03:19,470 --> 00:03:33,150 Either you can use command prompt or you can navigate to the C drive, go to windows and search for 47 00:03:33,150 --> 00:03:38,880 system 32 and search for Kelsi OC. 48 00:03:39,780 --> 00:03:45,930 Copy this, go to C drive magic folder and paste here. 49 00:03:47,670 --> 00:03:51,770 See the size of calculator file is 27 KB. 50 00:03:53,190 --> 00:04:00,720 Now the next step is to type this command, so let's do that. 51 00:04:02,860 --> 00:04:08,230 So type C colon backslash magic. 52 00:04:09,960 --> 00:04:10,710 Kelsey. 53 00:04:13,360 --> 00:04:14,260 Do it again. 54 00:04:16,450 --> 00:04:17,110 Again. 55 00:04:17,140 --> 00:04:19,480 See Colon, backslash magic. 56 00:04:20,170 --> 00:04:21,850 Then the file name. 57 00:04:22,680 --> 00:04:26,320 Colin Kelsey, dot xy. 58 00:04:26,830 --> 00:04:31,960 So we're actually hiding calculator behind our text file. 59 00:04:33,960 --> 00:04:34,530 Then. 60 00:04:35,400 --> 00:04:38,940 Now the next step is to check the size of the file. 61 00:04:39,480 --> 00:04:40,860 So the are. 62 00:04:44,100 --> 00:04:49,620 See guys the size of the file 13 bytes is the same as earlier. 63 00:04:50,500 --> 00:04:59,220 Instead, we have attached this calculator file behind this text file, but still the size of the file 64 00:04:59,460 --> 00:05:01,710 has not yet increased. 65 00:05:02,100 --> 00:05:02,700 Right. 66 00:05:02,700 --> 00:05:07,560 So nobody knows that behind this 13 bytes file. 67 00:05:07,590 --> 00:05:11,190 There is a 27 KB file attached. 68 00:05:11,760 --> 00:05:12,330 Right. 69 00:05:12,690 --> 00:05:16,980 Now let's delete calculator file. 70 00:05:17,940 --> 00:05:21,330 So go to magic folder and delete this file. 71 00:05:24,290 --> 00:05:28,820 Now the last command is to create a symbolic link. 72 00:05:29,900 --> 00:05:31,130 So let's do that. 73 00:05:32,000 --> 00:05:33,020 And killing. 74 00:05:34,010 --> 00:05:38,360 Let's name it Backdoor Dot xy. 75 00:05:40,560 --> 00:05:45,710 Then the name of the file, read it or text Colin, Kelsey or Tracy. 76 00:05:46,620 --> 00:05:49,710 See it says Symbolic link created for backdoor. 77 00:05:50,100 --> 00:06:00,030 Now let's see the magic when someone opens this file or if someone executes this file. 78 00:06:01,110 --> 00:06:07,440 Suppose I type backdoor dot xy which is attached to read me dot text. 79 00:06:08,310 --> 00:06:14,880 But in actually in the background calculator will be executed. 80 00:06:15,330 --> 00:06:20,580 So if we type backdoor dot xy, we will see a calculator opening. 81 00:06:22,140 --> 00:06:23,850 So let's enter. 82 00:06:30,530 --> 00:06:31,250 Okay. 83 00:06:32,570 --> 00:06:35,140 First, let's check whether this file created or not. 84 00:06:35,150 --> 00:06:37,700 So yes, backdoor x is created. 85 00:06:37,730 --> 00:06:40,640 Now let's run backdoor dot xy. 86 00:06:40,910 --> 00:06:45,200 See, we have opened the file backdoor. 87 00:06:45,230 --> 00:06:47,960 But actually calculator's open. 88 00:06:47,980 --> 00:06:52,580 So this way we can attach an executable file behind a text file. 89 00:06:53,420 --> 00:07:01,380 So when your target actually runs, another file that is backdoor are real file which is hidden. 90 00:07:01,400 --> 00:07:03,140 In this case it is calculator. 91 00:07:03,140 --> 00:07:04,580 So it will open. 92 00:07:05,090 --> 00:07:05,720 Right. 93 00:07:06,620 --> 00:07:12,620 So this is how we can hide data or files using NTFS stream. 94 00:07:12,650 --> 00:07:20,510 Now in the next video I will show you how to hide some data using whitespace steganography.