Free CTF Forensics Lab
Every browser-based forensics tool you need for CTF competitions — file identification, steganalysis, cipher solving, and PCAP analysis. No install required. Files are processed locally — never uploaded.
Last updated: August 2026 · 3 tools live · 35 in development
Available Now
3 tools live today — use them in your next CTF
File Type / Magic Byte Detector
LiveIdentify any file's true format from magic bytes — not the extension. Detects mismatches, polyglots, and corrupted headers.
Strings Extractor
LiveExtract printable strings from binary files in your browser. ASCII + UTF-16LE, byte offsets, regex filtering, and CTF flag-pattern detection.
Hex Viewer / Editor
LiveBrowse, search, and edit raw bytes of any file up to 100 MB — with magic-byte detection, pattern highlighting, and direct download of your modified file.
CTF Triage Pipeline
The standard workflow for any unknown challenge file — follow these steps in order:
Identify the file
Never trust the extension. Drop the file into the Magic Byte Detector to learn its true format from the raw header bytes.
File Type DetectorExtract strings
Run the Strings Analyzer to pull every printable sequence ≥ 4 characters. Flags, URLs, and encoding hints often appear here.
Strings AnalyzerCheck metadata
For images, audio, and PDFs, inspect all EXIF/XMP/IPTC fields. CTF authors routinely hide flags in camera make/model, GPS, or custom tags.
Dig deeper
Use format-specific tools: bit-plane filters for images, spectrograms for audio, stream reconstruction for PCAP captures.
Where to Start
Pick the right tool for your experience level:
No prior CTF experience needed
- File Type Detector
- Strings Analyzer
- Base64/Hex Auto-Decoder
- ROT13 / Caesar Solver
- Binary / Hex Converter
Familiar with common CTF formats
- PNG Chunk Analyzer
- Bit Plane Visualizer
- zsteg — LSB Detector
- XOR Cipher Analyzer
- Hash Identifier + Cracker
- Steghide Extractor
For CTF veterans and forensics pros
- StegSolve Online
- Stegseek / Stegcracker
- PCAP Viewer / Parser
- Embedded File Scanner
- Audio Spectrogram Analyzer
- Multi-layer Auto-Decoder
Tool Roadmap
35 tools in development across 6 categories — updated as each cluster ships.
File & Forensics Analysis
Identify any file's true format, inspect raw bytes, extract metadata, and scan for embedded payloads — the essential first-pass toolkit for every CTF challenge file.
Image Steganography
Bit-plane filters, channel splitters, entropy heatmaps, and CLI-equivalent extractors for every common CTF image steganography technique.
Audio Forensics
Spectrogram analysis and SSTV decoding — the two most common audio forensics steps in CTF competitions.
Encoding & Cipher Decoders
Auto-decode Base64/Hex/URL chains, solve classical ciphers, crack hashes, and decode JWTs — all without leaving the browser.
Network / PCAP Forensics
Parse PCAP captures, reconstruct TCP streams, extract HTTP objects, and pull auth hashes — a browser-based Wireshark alternative for CTF network challenges.
Challenge Generators
Build Steghide, LSB, and PCAP challenges ready to distribute at your next CTF — with auto-generated hints, solve scripts, and configurable difficulty.
Prefer the terminal?
These browser tools replicate the most-used CTF forensics commands — use them on a restricted machine or when you want results without spinning up a VM.
| CLI command | Browser equivalent | Status |
|---|---|---|
| file <challenge> | File Type / Magic Byte Detector | Live |
| strings <challenge> | Strings Analyzer | Live |
| xxd <file> | head | Hex Viewer / Editor | Coming soon |
| exiftool <image> | ExifTool-style Metadata Extractor | Coming soon |
| binwalk <file> | Embedded File Scanner | Coming soon |
| stegsolve.jar | StegSolve Online | Coming soon |
| zsteg image.png | zsteg — LSB Detector | Coming soon |
| steghide extract -sf | Steghide Extractor | Coming soon |
| tshark -r capture.pcap | PCAP Viewer / Parser | Coming soon |
| cyberchef magic | Multi-layer Auto-Decoder | Coming soon |
Magic Bytes Quick Reference
What are magic bytes?
Every file format defines a fixed sequence of bytes that must appear at the start (or a specific offset) of any valid file in that format. These are called magic bytes or file signatures. When you rename a file or strip its extension, the magic bytes still reveal the true format — making them the most reliable identification method in CTF forensics. Tools like file on Linux and the File Type Detector here use exactly this technique. The Strings Analyzer can also surface ASCII-readable magic bytes inside binary files.
| Format | Hex signature | Note |
|---|---|---|
| PNG | 89 50 4E 47 0D 0A 1A 0A | Always identical — most reliable |
| JPG | FF D8 FF | First 3 bytes; FF D9 at EOF |
| GIF | 47 49 46 38 | GIF87a or GIF89a |
| ZIP | 50 4B 03 04 | Also .docx, .xlsx, .apk, .jar |
| 25 50 44 46 2D | %PDF- (version follows) | |
| ELF | 7F 45 4C 46 | Linux executables & shared libs |
| MP3 | 49 44 33 | ID3 tag header; or FF FB for raw |
| WAV | 52 49 46 46 ... 57 41 56 45 | RIFF....WAVE (bytes 0-3 + 8-11) |
| WebP | 52 49 46 46 ... 57 45 42 50 | RIFF....WEBP (bytes 0-3 + 8-11) |
| GZIP | 1F 8B | Also .tar.gz, .tgz payloads |
| RAR | 52 61 72 21 1A 07 | Rar! magic (v4); 00 for RAR5 |
| 7z | 37 7A BC AF 27 1C | 7z archive — check if nested zip |
| BMP | 42 4D | BM — common CTF palette stego target |
| FLAC | 66 4C 61 43 | fLaC — check for LSB audio stego |
| MP4 | xx xx xx xx 66 74 79 70 | ftyp at offset 4 (box type field) |
| SQLite | 53 51 4C 69 74 65 20 66 | SQLite format 3 — first 8 bytes |
| PE/EXE | 4D 5A | MZ — Windows PE; PE header at 0x3c offset |
| TAR | 75 73 74 61 72 | ustar at byte offset 257 (not offset 0) |
Frequently Asked Questions
Do I need to install anything?
No. Every CTF Lab tool runs 100% in your browser via JavaScript and WebAssembly. No extensions, no Python, no Docker — just open the page and start.
Are my files uploaded to a server?
No. Files are processed locally in your browser using the FileReader API and Web Workers. They are never uploaded to our servers.
What's the difference between CTF Mode and Basic mode on the file detector?
CTF Mode shows CLI commands (file, xxd, binwalk, strings) alongside the browser result so you can pivot to terminal tools instantly. Basic mode shows a clean visual-only report.
Which tools are live right now?
File Type / Magic Byte Detector and Strings Extractor and Hex Viewer / Editor are live today. The remaining 35 tools are in active development — the next cluster (Image Stego) is next in the queue.
How does magic byte detection work?
The file detector reads only the first 512 bytes of your file and matches them against a database of 100+ file signatures. The filename extension is ignored — only the raw bytes matter.
Can I use these tools in a real CTF competition?
Yes — that's the entire purpose. All processing is client-side, so there are no rate limits, no accounts required, and no data retention of any kind.