File type identifier by magic bytes
Drop a file and identify what it really is from its signature, regardless of extension. Also finds file headers embedded inside other files.
Open in ctfpalExtensions are a suggestion; the first bytes of a file are the fact. A challenge that hands you flag.jpg which is actually a ZIP is not being clever, it is testing whether you looked. This is the first thing to do with any file, before opening it in anything.
Embedded signatures matter more than the first one
The header tells you what the file claims to be. Scanning the whole file for signatures tells you what is hidden inside it. A PNG with a ZIP header 40KB in is a polyglot: the image viewer reads the front, the archive tool reads the back, and both are satisfied. This is the single most common file-forensics setup in CTF.
| Bytes | Format | Note |
|---|---|---|
50 4B 03 04 | ZIP | Also DOCX, XLSX, JAR, APK |
89 50 4E 47 | PNG | Followed by \r\n\x1a\n |
FF D8 FF | JPEG | Ends with FF D9 - data after that is appended |
1F 8B | gzip | Often nested several deep |
7F 45 4C 46 | ELF | Linux executable |
25 50 44 46 | %PDF | |
52 61 72 21 | RAR | Rar! |
Part of a module
7. File forensics and carving
Identify files by their bytes, find data appended past a format’s end marker, and pull evidence out of images and documents.
Practise on real challenges
Go deeper
- The first ten minutes: a triage playbook for any CTF challengeMost challenges are lost to flailing, not to difficulty. Here is a repeatable order of operations for an unknown blob, an unknown file, and an unknown service - and the point at which you should stop guessing and start reading.
Related tools
Magic byte and file signature table
Look up any file format by its magic bytes, or any byte sequence by format - including the trailers that mark where a file ends.
Strings extractor for binaries and blobs
Pull printable ASCII and UTF-16 strings out of any file, filtered by length, with flag-pattern highlighting.
Hex viewer and hexdump
Inspect any file byte by byte with a side-by-side hex and ASCII view, offsets, and structure highlighting.
Automatic steganography solver
Throw every applicable steganography technique at a file at once - image, audio, archive, text, and document - recursively unpack what falls out, and surface flag matches.