File Magic / Signature Identifier

What are magic numbers

A magic number is a short, fixed sequence of bytes at the start of a file (or at a known offset) that identifies the file format. PNG starts with 89 50 4E 47 0D 0A 1A 0A, a ZIP archive starts with 50 4B 03 04 (which spells PK for Phil Katz, the creator of PKZIP), and a Linux ELF executable starts with 7F 45 4C 46 (the bytes spell .ELF). Operating systems and tools like file, binwalk, and antivirus engines use these signatures rather than file extensions, which can lie.

For CTF forensics, the most common pattern is a file with the wrong extension. A challenge might hand you flag.txt that is actually a PNG, or a corrupted PDF that is actually a ZIP. Drop the file here to see what it really is. Office files (.docx, .xlsx, .pptx), JAR files, APK files, and EPUB files all share the ZIP signature because they are ZIP archives at heart.

Once you know the real type, your next step depends on what it is. For images, run the Image Metadata Viewer to read EXIF and PNG text chunks. For executables and unknown binaries, run the Strings Extractor to pull printable text. For dense binary data, the Hex Viewer gives you a structured view with offsets and ASCII sidebar.

If the file’s magic number does not match its extension, that is almost always a deliberate clue. Rename the file, run the appropriate parser, and check for embedded content. binwalk -e file on the command line will recursively unpack many container formats automatically.