Strings Command Cheatsheet
Installation Instructions
# Option 1: Download from Windows Sysinternals
# Visit: https://docs.microsoft.com/en-us/sysinternals/downloads/strings
# Option 2: Install via Chocolatey
choco install sysinternals
# Debian/Ubuntu
sudo apt-get install binutils
# RHEL/CentOS
sudo yum install binutils
# Arch Linux
sudo pacman -S binutils
# Using Homebrew
brew install binutils
# Note: The command might be accessible as gstrings
Basic string extraction:
Set minimum string length:
strings -n [length] filename
Show file offsets in decimal:
Show file offsets in hexadecimal:
Search for wide character strings:
strings -e l filename # little-endian 16-bit
strings -e b filename # big-endian 16-bit
strings -e L filename # little-endian 32-bit
strings -e B filename # big-endian 32-bit
Print filename before each string:
Print section header before each string:
strings --section filename
Scan entire file (not just data sections):
Output to file:
strings filename > output.txt
Find specific strings:
strings filename | grep " pattern"
Count number of strings:
Sort strings uniquely:
strings filename | sort -u
Process multiple files:
strings file1 file2 file3
Process all files in directory:
Recursive string search:
find . -type f -exec strings {} \;
Search for specific encoding:
strings -e s filename # single-7-bit-byte characters (ASCII, ISO 8859)
strings -e S filename # single-8-bit-byte characters
strings -e b filename # 16-bit big-endian
strings -e l filename # 16-bit little-endian
Show strings with context:
Target specific sections:
strings --target=section_name filename
Print strings in octal:
Combine with other tools:
strings filename | grep -i " password"
strings filename | awk ' length($0)>20'
strings filename | sed ' s/^/FOUND: /'
Analyze process memory:
Analyze core dump:
Analyze memory dump:
Find email addresses:
strings filename | grep -E " [A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}"
Find URLs:
strings filename | grep -E " https?://[^\s]+"
Find IP addresses:
strings filename | grep -E " \b([0-9]{1,3}\.){3}[0-9]{1,3}\b"
Print only printable characters:
Ignore case in pattern matching:
strings filename | grep -i " pattern"
Count string occurrences:
strings filename | sort | uniq -c
Find strings between markers:
strings filename | sed -n ' /START/,/END/p'
Use multiple threads:
strings --threads=4 filename
Set buffer size:
strings --buffer-size=1024 filename
Process compressed files:
Find potential passwords:
strings filename | grep -i " pass"
Find potential usernames:
strings filename | grep -i " user"
Find potential API keys:
strings filename | grep -E " [A-Za-z0-9]{32}"
Analyze PDF strings:
strings -a file.pdf | grep " /Uri"
Analyze ELF headers:
strings -a binary | grep " ^ELF"
Find embedded scripts:
strings filename | grep -E " ^#!"
Custom delimiter:
strings filename | tr ' \n' ' ,'
Remove empty lines:
strings filename | grep .
Format as JSON:
strings filename | jq -R -s ' split("\n")[:-1]'
Timeline analysis:
strings -t d filename | grep " 2024"
Find file signatures:
strings -a filename | grep -i " JFIF\|PNG\|PDF"
Extract metadata strings:
strings filename | grep -i " creator\|producer\|author"
Integration with Other Tools
Pipe to less:
Create word frequency list:
strings filename | tr ' ' ' \n' | sort | uniq -c | sort -nr
Extract and decode base64:
strings filename | grep -Eo ' [A-Za-z0-9+/]{40,}' | base64 -d
Find debug strings:
strings filename | grep -i " debug\|error\|warning"
Locate version strings:
strings filename | grep -i " version\|v[0-9]\.[0-9]"