PicoCTF extensions Writeup: Fixing a Misleading File Extension

extensions is a picoCTF 2019 forensics challenge about trusting file signatures over filenames. The downloaded file looks like a text file, but the content tells a different story.

File Type Check

file flag.txt
mv flag.txt flag.png

The file signature identifies the data as an image, so renaming it to .png makes it easier to open normally.

Flag

open flag.png

Key Takeaways

1. File extensions are labels; file signatures are evidence.
2. The file command is one of the fastest first checks in forensics.
3. Renaming a file can be enough when the underlying bytes are already valid.