ZIP archive inspector
Read a ZIP’s central directory and local headers, spot mismatches used to hide files, and check encryption and compression per entry.
Open in ctfpalA ZIP stores each file twice in terms of metadata: once in a local header before the data, and once in a central directory at the end. Extraction tools read the central directory. That redundancy is exactly what challenges exploit.
Hiding by disagreement
If an entry exists in the archive with a local header but is omitted from the central directory, unzip will not list it or extract it - but the data is right there. Comparing the two listings surfaces anything hidden this way, and the mismatch is itself the signal that something was done deliberately.
- Entries in local headers but not the central directory - hidden files.
- Size or CRC mismatches between the two - tampering, or a corrupted archive to repair.
- A per-entry encryption flag - only some entries are encrypted, so the others come out for free.
- Compression method 0 (stored) - the data is uncompressed, so strings works directly on the archive.
Related tools
Magic byte and file signature table
Look up any file format by its magic bytes, or any byte sequence by format - including the trailers that mark where a file ends.
Office macro and OLE extractor
Extract VBA macros from DOCM, XLSM, and legacy OLE documents, and deobfuscate the string-concatenation tricks they hide behind.
Java .class disassembler
Disassemble JVM bytecode, read the constant pool, and recover strings and logic from .class and .jar files.
Automatic steganography solver
Throw every applicable steganography technique at a file at once - image, audio, archive, text, and document - recursively unpack what falls out, and surface flag matches.