File Analysis — Hub
OSCP boxes and CTF challenges often hide creds, paths, or flags in files — binaries, images, PDFs, firmware. Start here, then drill into dedicated tool notes.
| Tool | Note | Purpose |
|---|---|---|
| strings | Below | Readable text from binaries |
| exiftool | exiftool | EXIF/XMP/IPTC metadata — full flags reference |
| binwalk | Below | Embedded files / firmware carving |
| file | Below | Identify true file type |
| Stego | Steghide, |
Before deep analysis: Steghide, xxd, OpenSSL (decrypt/hash).
📌 1) strings — Extract Readable Text
strings file.bin
strings -n 8 file.bin # Min length 8 (less noise)
strings -a file.bin # Scan entire file
strings file.bin | grep -i password
strings file.bin | grep -iE "(pass|key|secret|flag|/home|/var)"OSCP use: Unknown binaries, .exe on shares, firmware, memory dumps.
📌 2) exiftool — See Dedicated Note
Full command reference, all flags, EXIF PHP bypass, batch processing:
→ exiftool
Quick start:
exiftool image.jpg
exiftool -Comment -GPS:All -Software image.jpg
exiftool -a -s -G1 image.jpg | grep -iE "comment|flag|path"📌 3) binwalk — Embedded Files
binwalk file.bin
binwalk -e file.bin # Extract
binwalk -Me file.bin # Recursive extract
binwalk -E file.bin # Entropy graph
binwalk --dd='.*' file.bin # Carve allOutput: _file.bin.extracted/ — inspect with strings, file, xxd.
| Flag | Description |
|---|---|
-e | Extract known types |
-M | Recursive extraction |
-E | Entropy analysis |
-A | Scan entire file (not just headers) |
-f | Force extraction (broken sigs) |
-r | Recurse into extracted dirs |
-C DIR | Extract to directory |
--dd=TYPE | Custom carve spec |
📌 4) file Command
Always run first:
file suspicious.bin
file upload.php.jpg
# PHP disguised as JPEG → "PHP script, ASCII text"📌 5) Combined Workflow
file unknown.dat
strings -n 6 unknown.dat | head -50
exiftool unknown.dat 2>/dev/null # → see [[exiftool]]
binwalk unknown.dat && binwalk -e unknown.dat
# Encrypted / hashed loot
openssl dgst -sha256 unknown.dat # → [[OpenSSL]]
openssl enc -d -aes-256-cbc -in unknown.enc -out out -pass pass:try
# Stego
steghide info image.jpg
steghide extract -sf image.jpg📌 6) OSCP / CTF Checklist
□ file <name>
□ strings -n 6 <name> | grep -i pass
□ exiftool <name> (full: [[exiftool]])
□ binwalk <name> && binwalk -e <name>
□ steghide / xxd if image or audio
□ openssl enc/dgst if encrypted or hashed
📌 Quick Cheat Sheet
file unknown && strings -n 8 unknown | grep -i pass
exiftool -a -s image.jpg
binwalk -Me firmware.bin