Skip to main content
picoCTF Solutions
picoCTF 2019ForensicsMedium

extensions picoCTF 2019 Solution

A file whose true format is disguised by a misleading extension. Identify what it really is to recover the flag.

Published: April 2, 2026Updated: August 13, 2026

Description

This is a really weird text file TXT? Can you find the flag? Download flag.txt.

Setup

Download flag.txt from the challenge page.

Solution

Want to try it yourself first?

The guided walkthrough reveals hints one step at a time.

Walk me through it
  1. Step 1Check the true file type
    Observation
    The challenge calls flag.txt a 'really weird text file'. That hints the extension is lying about the format, so run the file command to read the magic bytes and see what it actually is.
    The file command reads the magic bytes at the start of a file to determine its actual format, ignoring the extension. Running it on flag.txt reveals it is actually a PNG image, not a text file.
    bash
    file flag.txt

    Expected output

    flag.txt: PNG image data, 1400 x 2100, 8-bit/color RGBA, non-interlaced
    What didn't work first

    Tried: Open flag.txt directly in a text editor to read the flag

    A text editor renders raw bytes as characters, so the PNG signature and binary data come out as garbled symbols and blank space. The flag is drawn in the image pixels, not stored as ASCII in the file.

    Tried: Run strings flag.txt hoping the flag is embedded as a readable string

    strings pulls printable ASCII out of any binary, but here the flag is drawn into the image as visible text rather than stored as a string. PNG pixel data is compressed and filtered, so strings returns only metadata noise.

    Learn more

    The file command determines a file's type by reading its magic bytes - a special byte sequence at the very beginning of the file that identifies its format. Most file formats define a unique signature: JPEG files start with FF D8 FF, PNG files start with 89 50 4E 47 0D 0A 1A 0A (which is \x89PNG\r\n\x1a\n), ZIP files start with 50 4B 03 04, and so on.

    File extensions are merely naming conventions - operating systems use them as hints to associate files with applications, but they carry no enforcement. Any file can be renamed with any extension regardless of its actual content. The file command bypasses the extension entirely and inspects the actual bytes, making it a reliable first step when analyzing unknown files in CTF challenges.

    This mismatch between name and content is a classic CTF technique and a real-world security concern. Attackers sometimes rename malicious executables with innocent extensions (e.g., .jpg, .pdf) to bypass naive filters. Security tools and antivirus scanners always inspect file content rather than relying solely on extensions.

  2. Step 2Rename the file and open it
    Observation
    The file command identifies flag.txt as a PNG image. Rename it with a .png extension so an image viewer will open it and show the flag.
    Rename the file to give it a .png extension so your image viewer will open it correctly. The flag is visible in the image.
    bash
    mv flag.txt flag.png
    bash
    eog flag.png
    What didn't work first

    Tried: Try to open flag.txt directly with eog or another image viewer without renaming first

    Most viewers decide how to interpret a file from its extension or MIME type. eog may refuse a .txt file, or claim the format is unsupported, even though the bytes are valid PNG. Renaming to .png tells the viewer what it is looking at.

    Tried: Use xxd or hexdump to manually read the pixel data looking for the flag bytes

    PNG stores pixels DEFLATE-compressed and filtered, not as readable bytes, so a hex dump shows compressed binary with no flag pattern in it. Decode the PNG normally with a viewer and read the flag off the rendered image.

    Learn more

    Once the true file type is confirmed, giving the file the correct extension allows standard tools to open it properly. On Linux, eog (Eye of GNOME) is the default GNOME image viewer. Alternatives include feh, display (ImageMagick), xdg-open (which picks the system default), or simply opening the file in a web browser with firefox flag.png.

    The mv command renames files in place on the same filesystem - no data is copied. If you want to preserve the original while also having a renamed copy, use cp flag.txt flag.png instead. In CTF work, it's usually fine to rename directly since you can always re-download the original from the challenge server.

    For future challenges: whenever a file's content doesn't match its extension, or it refuses to open properly, always run file on it first. This habit reveals hidden formats and is one of the most consistently useful reflexes in forensics and reversing challenges.

Interactive tools
  • File Magic IdentifierIdentify file types from magic numbers. Paste hex bytes or drop a file to detect PNG, JPEG, ZIP, PDF, ELF, PCAP, SQLite, and dozens of other formats.

Flag

Reveal flag

picoCTF{now_you_know_about_extensions}

File extensions are just naming conventions - the actual file type is determined by magic bytes (the file signature) at the start of the file.

Key takeaway

Every binary format starts with a magic byte signature that identifies it regardless of what the filename claims. Extensions are a naming convention for humans; any filter or parser that trusts one without inspecting the content can be defeated by a rename. In malware analysis and forensic triage, checking magic bytes is the first move whenever the declared type looks suspicious.

Related reading

Tools used in this challenge

Where to go next

Try these next