CyberCheatsheets

strings Cheat Sheet

Extract printable strings from binaries and dumps to find URLs, flags, passwords, and error messages.

Exploitation & PayloadsbinaryforensicsreconUpdated 2026-06-02

Overview

strings scans files for ASCII/UTF-16 sequences. First-pass recon on unknown binaries, memory dumps, and firmware without disassembling everything.

Authorized testing only. Use only on systems, networks, and accounts you own or have explicit written permission to test. Unauthorized access is illegal.

Install

binutils (standard on Linux)

sudo apt install -y binutils
strings --version

Essential commands

Default (min length 4)

strings binary

Longer minimum — less noise

strings -n 8 binary

All sections including .data

strings -a binary

Unicode (UTF-16LE common on Windows)

strings -el win.exe

Common workflows

Quick binary triage —

strings -n 6 ./vuln | grep -iE 'password|flag|/bin/|http|error'
strings -a ./vuln | less

Compare two binary versions —

strings old.bin > old.txt
strings new.bin > new.txt
diff -u old.txt new.txt

Firmware / disk image —

strings -n 10 firmware.bin | grep -i admin
strings -a -n 8 memory.dmp | grep -i '@' | head

Pipe to other tools —

strings libc.so.6 | grep '^/bin/'
objdump -d ./vuln | strings -n 4 - | head   # wrong tool combo — use:
strings ./vuln | grep 'CTF{'

With file type check —

file unknown.blob
strings -n 8 unknown.blob | head -50

Flags reference

-n N

Minimum string length (default 4)

-a

Scan entire file, not just loadable sections

-t x

Print offset in hex before each string

-t d

Decimal offset

-e l

UTF-16LE encoding

-e b

UTF-16BE encoding

-o

Alias for -t o octal offset

-w

Include whitespace-only “strings”

Tips

  • Use -n 8 or higher on large dumps to reduce garbage.
  • Hidden flags may be wide strings — try strings -el on Windows PE.
  • Combine with grep -E for IPs, emails, and paths.
  • rabin2 -zz binary (radare2) finds strings with virtual addresses for PIE.

References

Ähnliche Cheat Sheets