Lion Cipher Lab
Identify any file by its magic bytes (when the extension lies)
- Foundations
- Beginner
- ~30 min
- Free · no account required
Why it matters
A file's extension is cosmetic: it's just the part of the name after the dot, and anyone can rename `malware.exe` to `invoice.pdf` in one click. Email filters, users, and even some tools trust that label — which is exactly why attackers abuse it. The real identity of a file is written in its first few bytes, called magic bytes or a file signature. Learning to read those bytes, confirm them with the `file` command, and flag suspiciously high-entropy (compressed/encrypted-looking) blobs is the very first move in malware triage, forensic file carving, and checking a sketchy attachment before you…
What you'll learn
- file signatures / magic bytes
- reading a file as hex + ASCII
- using the `file` command (libmagic)
- Shannon entropy as a triage signal
- spotting a mislabelled or renamed file
Steps in this lab
- The one idea: bytes tell the truth, the extension does not
- Make yourself a lying file (the setup)
- Read the first bytes as hex + ASCII with xxd
- A pocket table of signatures to recognise
- Confirm with `file` — it reads bytes, not the name
- Entropy: a one-number 'is this compressed or encrypted?' signal
- The honest limits — where this can still fool you
- What you can now do that you couldn't before