https://th3b0ywh0l1v3d.github.io/tags/png/ Recent content in Png on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/misc/someone-said-steg/ Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/misc/someone-said-steg/ A 16-frame APNG hides one flag character per frame in the top-left pixel of each frame’s decompressed scanline data; every standard stego avenue is a dead end, so decompressing all 16 fdAT/IDAT streams and reading byte 4 of each yields the flag. https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/forensics/spoiled-cheese-pull/ Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/forensics/spoiled-cheese-pull/ A ‘PNG’ that file() calls a broken JPEG is a PNG with a forged signature and vandalized chunk names; repairing the header reveals an rMQR (rectangular Micro QR) barcode that ZXing decodes to the flag.