File Analysis
Analyze unknown files, identify file types, extract hidden content, and recover data from CTF forensics challenges.
File Analysis
When you receive an unknown file in a CTF, your first job is to figure out what it actually is — not what the extension says, but what the bytes say. From there, you extract whatever's hidden: metadata, embedded files, encoded payloads, or plaintext flags.
The initial triage is always the same five commands. Run them on every file before doing anything else. This solves more challenges than you'd expect.
Investigation Flow
Initial Triage (Always Do This First)
Identify the true file type
file suspicious_fileThe file command reads magic bytes — the first few bytes of a file that identify its type. A .jpg might actually be a ZIP, an ELF binary, or a PDF. Never trust the extension.
$ file "photo.jpg"
photo.jpg: PNG image data, 800 x 600, 8-bit/color RGB
# It's a PNG with a .jpg extension. The magic bytes say PNG.Extract readable strings
strings suspicious_file
strings -n 8 suspicious_file # min 8 chars (fewer false positives)
strings -e l suspicious_file # UTF-16LE (Windows files)This pulls every printable string from the binary. The flag is often hiding here as plaintext. Always grep for the flag format:
strings suspicious_file | grep -iE "(flag|ctf|key|secret)\{.*\}"Check all metadata
exiftool suspicious_fileThe Comment metadata field is the single most common place CTF authors hide flags in image files. Also check Artist, GPS coordinates, Software, and the embedded thumbnail.
# Extract thumbnail separately (sometimes different from main image)
exiftool -b -ThumbnailImage suspicious.jpg > thumb.jpgHex dump the beginning
xxd suspicious_file | head -50
hexdump -C suspicious_file | head -50This shows you the raw bytes. If the file is corrupted, you'll see wrong magic bytes here and can fix them.
Scan for embedded files
binwalk suspicious_file
binwalk -e suspicious_file # extractbinwalk scans for known file signatures embedded inside other files. A JPEG might contain a ZIP, which contains a text file with the flag.
What to Look For
# Flag format in strings
strings suspicious_file | grep -iE "(flag|ctf|key|secret)\{.*\}"
# Base64 blobs — decode them
strings suspicious_file | grep -E "^[A-Za-z0-9+/]{20,}={0,2}$" | while read b; do
echo "$b" | base64 -d 2>/dev/null | strings
done
# Hex-encoded strings
strings suspicious_file | grep -E "^[A-F0-9]{32,}$"File Type Identification
Extracting Embedded Content
# binwalk: finds and optionally extracts embedded files
binwalk --extract suspicious_file
ls _suspicious_file.extracted/
# foremost: file carving from raw data
foremost -i suspicious_file -o carved/
# dd: extract specific byte range (when you know the offset)
dd if=suspicious_file of=extracted.jpg bs=1 skip=1234 count=56789
# Compressed streams
file suspicious_file # → "gzip compressed data"
cp suspicious_file suspicious_file.gz
gunzip suspicious_file.gzMetadata Analysis
exiftool suspicious.jpg
# Fields to watch:
# Comment → flag often placed here
# Artist → hidden info
# GPS coordinates → geolocation challenge
# Software → reveals editing history
# Thumbnail → different from main image
# Remove all metadata (for testing)
exiftool -all= suspicious.jpgDocument Analysis
strings suspicious.pdf | grep -i flag
pdfinfo suspicious.pdf
pdftotext suspicious.pdf -
# Deeper analysis
pdf-parser.py suspicious.pdf -s flag
pip3 install peepdf
peepdf suspicious.pdfArchive Password Cracking
zip2john protected.zip > zip.hash
john zip.hash --wordlist=/usr/share/wordlists/rockyou.txt
hashcat -m 13600 zip.hash rockyou.txt # WinZip AES
hashcat -m 17210 zip.hash rockyou.txt # PKZIP (Classic)Dealing with Corrupted Files
CTF authors often corrupt file headers to make you fix them. The first step is always checking magic bytes with xxd file | head -1.
# PNG with wrong header — fix it:
python3 -c "
data = bytearray(open('broken.png','rb').read())
data[0:8] = b'\x89PNG\r\n\x1a\n'
open('fixed.png','wb').write(data)
"
# Check PNG integrity
pngcheck fixed.pngSteghide on Images
steghide extract -sf suspicious.jpg
steghide extract -sf suspicious.jpg -p "" # blank password
# stegseek — fast password crack for steghide
stegseek suspicious.jpg /usr/share/wordlists/rockyou.txtChecklist
-
file→ identify true type -
strings→ grep for flag format, base64, hex -
exiftool→ check all metadata fields, especially Comment -
xxd/hexdump→ look at raw bytes -
binwalk -e→ extract embedded files - For images:
steghide+stegseek - For archives:
john/hashcatwith rockyou.txt - For Office docs:
oletoolsfor macros,unzipfor XML - For PDF:
pdftotext+strings+peepdf - For corrupted files: check and fix magic bytes
Last updated on