File Signature Identifier | Security Tool by Husain Hakim
A cybersecurity tool designed to identify the true file type of a file by analyzing its 'magic numbers' (file signatures) rather than relying on its file extension. Includes a forensic hex viewer and spoofing detection.
Project Overview & Threat Context
A cybersecurity tool designed to identify the true file type of a file by analyzing its 'magic numbers' (file signatures) rather than relying on its file extension. Includes a forensic hex viewer and spoofing detection.
Problem Statement & Objective
In the real world, file extensions are just superficial labels. Attackers exploit this by renaming malicious executables to look like harmless documents. This tool bypasses the extension entirely, reads the raw binary data, and flags any deceptive spoofing attempts.
Security Concepts & Principles
- File Signatures (Magic Numbers)
- Spoofing & Masquerading Detection
- Polyglot File Analysis
- Binary Data Parsing
Technologies & Tools
- React
- Vite
- Vanilla CSS
- Python
- FastAPI
Technical Architecture & Mechanics
- Backend Pipeline: Python FastAPI handles file uploads in-memory, reading binary headers safely without disk writes.
- Hex Dump Generator: Calculates memory offsets, formats hex pairs, and decodes readable ASCII characters.
- Spoofing Logic: Compares detected magic numbers against the user-provided filename extension to programmatically detect spoofing.
- Frontend UI: Custom-built, brutalist React frontend designed to look like a true terminal/forensics tool, completely avoiding generic web templates.
Key Capabilities & Features
- True File Type Detection using a database of 30+ common file signatures.
- Automatic Spoofing Detection alerting users to extension mismatches.
- Forensics Hex Viewer displaying a raw hex dump of the file's first 256 bytes.
- Asymmetric Forensics-Lab UI designed specifically for security professionals.
Lessons Learned
- Gained hands-on experience parsing raw binary data and formatting hex dumps in Python.
- Deepened understanding of how attackers mask files using spoofing and polyglots.
- Learned how to connect a modern React/Vite frontend to a Python backend using FormData for file uploads.
- Focused on building UI/UX specifically for security tools, reinforcing the technical nature of the application.
Future Roadmap
- Implement YARA rule scanning for advanced payload detection.
- Add support for analyzing nested ZIP/Archive files without extracting to disk.
- Create a browser extension variant to automatically scan downloads.