Let's talk about steganography.
So what is steganography in simple terms, hiding a data behind another data is called steganography,
for example, hiding text behind another text or hiding image behind another image or hiding text behind
image or the hiding image behind video.
OK, also we can hide executable files behind image, so let's see how to do that.
Right.
So we will start with hiding files using NBFC stream.
OK, and what if it is a stream consist of a data associated with the main file or directory.
Right.
So in this spectacle we are going to hide calculator file.
Okay.
Gazy executable file, which is for a calculator and we will going to hide this behind a text file.
Right.
So in real world you can replace a calculator by your backdoor or by Trudgen.
Right.
So when someone opens a text file, it won't know that behind this text file there is another Trojan
or backdoor.
OK, but in the background that Drosnin will execute.
Right.
But the user is not able to see it.
So first of all, you have to follow these steps separated by comma.
Right.
So first of all, let's open command prompt.
So could run as admin.
Now, never get to see drive.
So the next step is to create a folder named Magic.
OK, so maybe magic, and now the next step is to open a notepad and create a phone call, read me and
say hello, world in it.
So notepad.
I hello one.
Right now, save this file into your magic folder.
So I'll give it a name, README.
No.
Bret Baier to list all the directories, first of all, let's navigate through magic folder and now
they I see here is the Refaeli we have recently created and its size is 13 bytes.
Remember this size.
OK, now the next step is to copy a calculator to magic folder.
OK, so the executable file for calculator is Ganassi Dot Yuxi.
So there are two ways to do this.
Either you can use command prompt or you can never get to the C drive.
Go to windows and search for sys 32.
And search for Kelsey, OK, copy this, go to Sue Drive Magic folder and based here.
OK, see the size of calculator file is 27 Gayby.
OK, now the next step is to type this command.
So let's do that.
So they see Golombek backslash magic.
Kelsey.
Do it again, again, see Golombek slash magic, then the final name, Colin Dot E.
OK, so we're actually hiding Kelvinator behind our next fake.
Done.
Now, the next step is to check the size of the fight, so the.
Zika is the size of the 513 bites is the same as earlier.
Instead, we help attach this calculator to find behind this text file.
But still, the size of the fight has not yet increased.
Right.
So nobody knows that behind this tartine bites.
Fine, then the 27 gabey fine attached right now.
Let's the calculator find.
OK, so go to magic folder and build this file.
Now, the last command is to create a symbolic link.
OK, so let's do that and killing, let's name it Backdoor Draft Yuxi.
Then the name of the file rudiment or text colon cancer or 3.x, you see it's symbolically created for
Bedau.
Now, let's see the magic when someone opens this file.
OK, what if someone executed this fight?
OK, suppose I type back door dot exit, which is attached to readme text.
OK, but in actually in the background calculator will be executed.
OK, so if they begged altered XY we will see a calculator opening.
OK, so let's enter.
OK, first, let's check whether this file created or not, so, yes, metadata is scooter.
Now let's turn back dot, dot.
See, we have an open file backdoor, but actually calculator's open.
So this way we can attach an executable file behind a text file.
OK, so then your target actually runs another file that is backdoor our little file, which is hidden
in this case it is calculator.
So it will open.
Right.
So this is how we can hide data or files using NTFS stream.
Now the next video, I will show you how to hide some data using whitespace steganography.