"Expect Zebras" is a steganography puzzle.
There is a flag file containing a key and contact information to send it to as proof of your solution.

(Based on an art-zine we did in the mid '00s)

******************************************************************
******************************************************************
******************************************************************
******************************************************************
*****COVER FILE

Stegsolve or threshold adjustments in the image editor of your choice reveals the only clue in the Cover file: ">" append symbol

Either Foremost or Binwalk will take care of this.
The tool from the "Easy as 0,1,1,2,3" puzzle will also work with some modification.

Foremost will reveal the main title stack: cover, table of contents (toc), and a fine illustration of Johnny Cash.

Binwalk will reveal those files as well as the thumbnail images attached to toc and Johnny.

*****TABLE OF CONTENTS

The instructions at the bottom of the page describe the clue for capturing the flag which, as with the "Easy..." puzzle, is hidden in the toc image.

Stegsolve (threshold) will reveal a little bunny silhoutte near one of the numbers, but that's not important, yet.

*****Johnny Cash

Stegsolve (threshold) reveals two bits of text:
- Art by Tric Blister (just a credit - he did all of the visual art in this, by the way)
- Hot & Blue which is the clue to the password for this image.

Research into Johnny's discography will show his first album being "Johnny Cash with His Hot and Blue Guitar!" The clue is "Hot & Blue", and the password is "Guitar".

*****MAZE

The instructions in the toc image say "For flag and subscription information, find the notebook at the end of the maze." Typing the correct password into steghide on the Johnny image produces the maze image.

If you don't know who the band called The Shags is, feel free to look them up.

Stegsolve (threshold) reveals three clues:
- the append symbol
- "GIMP opens PDF"
- "Without Foot Foot, we can't name the album!"

Foremost will give you the best results regarding the append symbol clue, revealing an appended PDF file. Binwalk doesn't know what to do with this stack, and there are no thumbnails added to the maze image.

*****NOTEBOOK

Reference the GIMP clue and open the PDF in that, or your prefered image editor (for best results, use Photoshop). The PDF is a piece called "An Excerpt from the Notebooks of Mefa Kane" which is written via the Exquisite Corpse game.

The purpose of the document isn't revealed until you deal with the last clue on the maze image.

*****OVERLAY

The last clue in the maze image is for the steghide password for the maze. Hopefully the text "name the album!" on its own line gets across that the password is the name of The Shags album, "Philosophy of the World".

Typing the correct password gives you the overlay text file. Opening the file shows, however, that it is an SVG file.

Change the file type to .svg and import or place the file into your notebook PDF project. Fit the SVG to the PDF image area, if your software doesn't already do that for you.

The overlay will reveal the phrase "ETTI device was wrong" - which is your final password!

*****SOLVE*****

Type the phrase in as your steghide password on the toc image to produce the flag text file.

CONGRATULATIONS! You've solved the puzzle!

******************************************************************
******************************************************************

EASTER EGGS

There are four eastereggs in the puzzle, providing additional content from the original zine. Each is also has its own little puzzle.

If you used Binwalk on the cover image, you revealed the thumbnail images attached to the toc and Johnny Cash images from the title stack. Otherwise, you can extract the thumbnails with Exiftool.

*****DOVETAIL

The multicolored chevron-type symbol thing is a dovetail joint. Stegsolve (threshold) reveals an additional clue to the password for this image - a silhouette of a dove with a very small arrow pointing at its tail.

The password is "dovetail" (SURPRISE!), and produces the dovetail text file, wherein is written the Dovetail Fiction (MadLibs) portion of the zine.

*****EASTER EGG

This one goes along with what Stegsolve (threshold) revealed in the toc image. The little bunny silhoutte sits next to the 34 in the toc.

Typing "34" in as the Steghide password doesn't work, though. Using Stegsolve (threshold) on the Easter Egg image reveals the word "sum" - so use "87" as the steghide password as it is the sum of all page numbers in the toc.

This produces the "Baseless Ideas" portion of the zine (just some weird shit).

*****ADVERT STACK

The final two easter eggs are found in the cover. The steghide password is hidden in the overlay file, though. Using the string in the "secret" node as the steghide password for the cover file produces the Vonnegut image.

Stegsolve (threshold) on the Vonnegut image reveals the append symbol, therefore Foremost or Binwalk should be used to produce the final file of all this.

******************************************************************
******************************************************************
******************************************************************
******************************************************************