Question 1

What are magic bytes?

Accepted Answer

Magic bytes (a file signature) are a short, fixed sequence at the very start of a file that identifies its true format — 89 50 4E 47 for PNG, 25 50 44 46 ('%PDF') for PDF, 50 4B ('PK') for ZIP and Office files, and 7F 45 4C 46 ('.ELF') for Linux executables. Unlike the filename, they reflect the actual content.

Question 2

Why can't I trust the file extension or Content-Type?

Accepted Answer

Both are attacker-controlled labels. A user can rename malware.exe to invoice.pdf and set any Content-Type header. If your upload handler decides how to process a file based on the name or the client-supplied header, an attacker can bypass filters — for example uploading an executable disguised as an image.

Question 3

How should servers validate uploaded file types?

Accepted Answer

Detect the type from the content by reading the magic bytes (libraries like libmagic / file, or language equivalents), verify it against an allowlist of expected types, and reject mismatches between the sniffed type and the claimed one. For images, re-encoding the upload through a trusted library strips any smuggled payload.

Magic Byte Sniff

How to play

Frequently Asked Questions