Linux06: File Identification

File extensions are cosmetic — attackers rename malicious binaries to look harmless all the time. Real identification happens by inspecting file content, not the name

Objective

Learner can determine a file true type from its content and distinguish text from binary/other formats

Mission

Several files with the identical .dat extension sit in ~/cases/case-1042/evidence/. Identify which one is an ELF executable payload, and report the service_id value found inside the genuine configuration text file

Commands you may need to solve this lab

filecat

Questions

1. Which command reveals a file true type regardless of its extension?

2. Why cannot file extensions alone be trusted during an investigation?

3. How does file output differ for a text file versus an executable binary?

Machine Offline

Isolated container is offline

Click "Start Machine" to boot your sandbox instance and choose your preferred interface