Using file

As we explained in the previous chapter, the file command is useful for providing quick information about a file on disk and is just one tool we can use in the initial phases of our analysis methodology. When combined with grep or other Linux commands, file becomes a powerful tool with more than a few use cases. For example, we need to use it for discovery to sort through potentially suspicious binaries on our hosts and for information gathering to make sure we understand the format of an executable binary. We can even use the output from file to determine whether or not the file we're examining is using a different format altogether. For example, picture a capture the flag scenario where you're given a file called mystery.zip. Running the file command against this file shows us that the naming convention of the file is meant to try and throw us off by using...