strings

Reverse Engineering

Beginnerlow risk

strings prints the sequences of printable characters in files. Useful for finding hidden text, URLs, and clues in binaries.

Installation

sudo apt install binutils

Basic Syntax

strings [options] <file>

Quick Facts

Full Name

strings (GNU Binutils)

License

GPL

Language

C

Platforms

Linux, macOS, Unix

Category

Binary Analysis

Part Of

GNU Binutils

Tool Overview

strings is a command-line utility that prints sequences of printable characters found in files. It is one of the simplest yet most useful binary analysis tools.

The tool is commonly the first step in binary triage. It reveals hidden URLs, IP addresses, credentials, error messages, and other text embedded in compiled code.

strings works on any file type and requires no installation on Linux. It is indispensable for malware analysis, CTF challenges, and digital forensics.

Common Commands

strings /path/to/filePrint printable character sequences (min length 4) from a file

strings -a /path/to/fileScan the entire file, not just initialized/loaded sections

strings -n 8 /path/to/fileOnly print strings at least 8 characters long

strings -t x /path/to/filePrefix each string with its file offset in hexadecimal

strings -t d /path/to/filePrefix each string with its file offset in decimal

strings -t o /path/to/filePrefix each string with its file offset in octal

strings -o /path/to/fileShorthand for -t o, printing octal offsets

strings -f /path/to/filePrint the file name before each detected string

strings -e s /path/to/fileSearch for single-byte (ASCII) encoded strings

strings -e l /path/to/fileSearch for 16-bit little-endian (UTF-16LE) strings

strings -e b /path/to/fileSearch for 16-bit big-endian encoded strings

strings -e L /path/to/fileSearch for 32-bit little-endian encoded strings

strings -e B /path/to/fileSearch for 32-bit big-endian encoded strings

strings -e S /path/to/fileSearch for single-8-bit-byte encoded strings

strings -w /path/to/fileInclude all whitespace characters as part of strings

Step-by-Step Guide

1Execute the utility against your target file
2Use grep to filter the output for interesting terms
3Adjust the length parameters to hide short, meaningless characters
4Search the output for embedded IP addresses, web links, or credentials
5Document any significant discoveries for your report

Warnings

This tool might expose highly sensitive data or passwords
Ensure you have permission to analyze the file
A large portion of the output will be arbitrary memory garbage

Use Cases

Credential Discovery

Find embedded passwords and API keys.

CTF Challenges

Find hidden flags and clues in binaries.

Malware Triage

Quickly extract IOCs from malware samples.

URL and IP Extraction

Find network indicators in binaries.

Key Features

String Extract: Find all printable character sequences.
Length Filter: Filter by minimum string length.
Encoding: Support for ASCII, Unicode, UTF.
Any File: Works on any file type.
Fast: Instant results on most files.

Related Tools

objdump

Binary Analysis

Disassemble and inspect binary headers.

Frequently Asked Questions

What is strings used for?

strings extracts printable character sequences from files. It is used to find hidden text, URLs, passwords, and clues in binaries.

How do I use strings?

Run strings binary to extract strings, or strings -n 10 binary to filter for strings at least 10 characters long.

Can strings find passwords?

Yes, strings is often the first tool to find embedded credentials, API keys, and passwords in binaries.

What is strings -e for?

strings -e changes encoding. Use -e l for little-endian 16-bit, -e L for big-endian 16-bit, -e b for 8-bit.

Output Explanation

Simply prints out any consecutive sequence of human-readable characters found embedded within the compiled machine code.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.