ForensicsRuns locallyNo account
File type identifier by magic bytes
Drop a file and identify what it really is from its signature, regardless of extension. Also finds file headers embedded inside other files.
Open in ctfpalExtensions are a suggestion; the first bytes of a file are the fact. A challenge that hands you flag.jpg which is actually a ZIP is not being clever, it is testing whether you looked. This is the first thing to do with any file, before opening it in anything.
Embedded signatures matter more than the first one
The header tells you what the file claims to be. Scanning the whole file for signatures tells you what is hidden inside it. A PNG with a ZIP header 40KB in is a polyglot: the image viewer reads the front, the archive tool reads the back, and both are satisfied. This is the single most common file-forensics setup in CTF.
| Bytes | Format | Note |
|---|---|---|
50 4B 03 04 | ZIP | Also DOCX, XLSX, JAR, APK |
89 50 4E 47 | PNG | Followed by \r\n\x1a\n |
FF D8 FF | JPEG | Ends with FF D9 - data after that is appended |
1F 8B | gzip | Often nested several deep |
7F 45 4C 46 | ELF | Linux executable |
25 50 44 46 | %PDF | |
52 61 72 21 | RAR | Rar! |