HackBlue

Tools · CTF categories for beginners · 03 / 18

First steps with an unknown file: file, strings, xxd, exiftool, and binwalk

Apply a repeatable triage routine to any challenge file: identify its real type, read printable strings, inspect bytes, check metadata, and look for embedded content.

10 min read · practice only with authorization

The routine

Do not trust the file extension. file reads magic bytes to identify the real format. strings prints readable text, which often includes hints, URLs, or the flag itself in easy challenges. xxd shows bytes in hex so you can spot headers, trailers, and appended data. exiftool reads metadata from images, documents, and media. binwalk looks for known file signatures inside the file.

Snippet
file mystery.bin
strings -n 6 mystery.bin | less
strings -el mystery.bin | head        # UTF-16 little-endian strings
xxd mystery.bin | head -20
xxd mystery.bin | tail -5
exiftool mystery.bin
binwalk mystery.bin

What to look for

A file whose magic bytes do not match its extension. Data after the official end marker, such as bytes after FF D9 in a JPEG or after the IEND chunk in a PNG. Metadata fields with comments, GPS coordinates, or authors. Base64-looking strings. Embedded archives that binwalk can extract.

Lab: build and solve your own

Create three practice files yourself: a PNG with a flag in an EXIF or PNG text comment, a JPEG with a ZIP appended, and a text file renamed to .jpg. Then pretend you do not know how they were made and run the routine on each. Note which tool revealed each flag.

Snippet
exiftool -Comment='flag{exif_practice}' photo.png
cat photo.jpg archive.zip > appended.jpg
cp notes.txt fake.jpg
for f in photo.png appended.jpg fake.jpg; do echo "== $f"; file "$f"; exiftool -Comment "$f"; binwalk "$f" | tail -n +4; done

Make it a habit

Run the routine every time, even when the challenge seems to be about something else. It takes a minute and frequently reveals the intended path. Keep a list of common magic bytes nearby: 89 50 4E 47 for PNG, FF D8 FF for JPEG, 50 4B 03 04 for ZIP, 25 50 44 46 for PDF, 7F 45 4C 46 for ELF.

Diagram

Common magic bytes

The first bytes identify the format.

  • 89 50 4E 47

    PNG

  • FF D8 FF

    JPEG

  • 50 4B 03 04

    ZIP (and DOCX, XLSX, JAR, APK)

  • 25 50 44 46

    PDF (%PDF)

  • 7F 45 4C 46

    ELF executable

Check yourself

1. Which command identifies a file type from its magic bytes?

2. Where do challenge authors often hide data in a JPEG?

3. Which magic bytes start a ZIP archive?