strings Command — Extracting Printable Text from Binary Files¶

The strings command extracts printable text from binary files. It is widely used in Linux system administration, malware analysis, reverse engineering, digital forensics, incident response, software debugging, and cybersecurity to inspect executables, libraries, firmware, memory dumps, and other binary files.

Learning Path¶

Linux Mastery → Module 3: Text Processing → Lesson 13

Difficulty: Intermediate

Reading Time: 35 Minutes

Course Progress

Course: Linux Mastery

Module: Text Processing

Lesson: 13 of 18

What You'll Learn¶

After completing this lesson, you'll be able to:

Understand the strings command
Extract printable text from binary files
Analyze executable files
Inspect shared libraries
Investigate suspicious binaries
Use strings in malware analysis
Combine strings with other Linux commands

Prerequisites¶

Before starting this lesson, complete:

Module 1 – Linux Fundamentals
Module 2 – Linux Command Line Essentials
Module 3 Lessons 1–12

Why Learn strings?¶

Imagine someone sends you an executable file.

backup_tool

You don't have its source code.

You want to know:

Does it contain URLs?
Does it reference passwords?
Which libraries does it use?
Does it connect to external servers?
Is it suspicious?

Instead of opening it in a hex editor:

strings backup_tool

You immediately see readable text embedded inside the binary.

What is strings?¶

The strings command scans binary files and displays sequences of printable characters.

Syntax:

strings [OPTIONS] FILE

It does not execute the file. It only extracts readable text.

Simple Example¶

Display printable strings from the ls command.

strings /bin/ls

Sample output:

Usage:

--help

--version

invalid option

coreutils

GNU

Extract Longer Strings¶

By default, strings displays printable sequences of 4 or more characters.

Display only strings with 8 or more characters.

strings -n 8 /bin/ls

or

strings --bytes=8 /bin/ls

Display File Offsets¶

strings -t x /bin/ls

Output:

0000340 GNU

00005ac Usage

00008f2 invalid option

Options:

x → Hexadecimal
d → Decimal
o → Octal

Analyze Shared Libraries¶

Example:

strings /lib/x86_64-linux-gnu/libc.so.6

You may see:

malloc

free

printf

GNU C Library

Search for URLs¶

strings application.bin | grep "http"

Example:

https://api.example.com

Search for IP Addresses¶

strings malware.bin | grep -E "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+"

Search for Email Addresses¶

strings file.bin | grep "@"

Search for API Keys¶

strings app.bin | grep -i "apikey"

Search for Passwords¶

strings application.bin | grep -i password

Analyze Shell Scripts Inside Binaries¶

Some compiled applications embed shell commands.

strings application.bin | grep "/bin"

Example:

/bin/bash

/bin/sh

Search for Configuration Files¶

strings application.bin | grep ".conf"

Example:

config.yaml

application.conf

Analyze Environment Variables¶

strings application.bin | grep PATH

Search for SQL Queries¶

strings database-tool | grep SELECT

Search for Error Messages¶

strings application.bin | grep ERROR

Search for Certificates¶

strings application.bin | grep BEGIN

Example:

-----BEGIN CERTIFICATE-----

Common strings Options¶

Option	Description
`-n N`	Minimum string length
`-t x`	Display hexadecimal offsets
`-t d`	Display decimal offsets
`-a`	Scan the entire file
`-e`	Specify character encoding

Combining with Other Commands¶

Search for URLs.

strings app.bin | grep http

Sort unique strings.

strings app.bin | sort | uniq

Count extracted strings.

strings app.bin | wc -l

Search for AWS references.

strings app.bin | grep AWS

Real Production Examples¶

Inspect an executable.

strings myapp

Inspect a Docker binary.

strings /usr/bin/docker

Inspect Kubernetes components.

strings /usr/local/bin/kubectl

Inspect OpenSSL.

strings /usr/bin/openssl

Inspect firmware.

strings firmware.bin

Cybersecurity Use Cases¶

strings is commonly used by:

Malware Analysts
Incident Responders
Security Researchers
Reverse Engineers
Digital Forensics Teams
SOC Analysts

Typical investigations include:

Hidden URLs
Hardcoded passwords
API endpoints
Encryption keys
Command execution paths
Suspicious domains

Production Perspective¶

Although developers and administrators use strings for debugging, it is especially valuable in:

Security audits
Binary inspection
Software verification
Incident response
Malware triage
Firmware analysis

It provides a quick first look at a binary without executing it.

Hands-on Lab¶

Task 1¶

Inspect the ls executable.

strings /bin/ls

Task 2¶

Display only strings longer than 10 characters.

strings -n 10 /bin/ls

Task 3¶

Search for "GNU".

strings /bin/ls | grep GNU

Task 4¶

Display hexadecimal offsets.

strings -t x /bin/ls

Task 5¶

Count extracted strings.

strings /bin/ls | wc -l

Task 6¶

Search for URLs.

strings /usr/bin/curl | grep http

Task 7¶

Search for configuration files.

strings application.bin | grep ".conf"

(Replace application.bin with a sample binary if available.)

Task 8¶

Sort unique strings.

strings /bin/ls | sort | uniq

Command Deep Dive¶

Command	Purpose	Production Example
`strings file`	Extract printable text	Binary inspection
`strings -n 8`	Longer strings	Malware analysis
`strings -t x`	Show offsets	Reverse engineering
`strings \\| grep`	Search extracted text	Incident response

Production Troubleshooting Scenario¶

Scenario

A security engineer receives an unknown executable from a compromised server.

Tasks:

Extract readable strings.
Search for URLs.
Search for IP addresses.
Search for embedded shell commands.
Count extracted strings.

Solutions:

strings suspicious.bin

strings suspicious.bin | grep http

strings suspicious.bin | grep -E "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+"

strings suspicious.bin | grep "/bin"

strings suspicious.bin | wc -l

Note

strings provides clues but does not prove malicious behavior. Further analysis with tools like file, readelf, objdump, or a sandbox may be required.

Mini Challenge¶

Analyze:

/bin/ls

Perform the following:

Display all printable strings.
Display only strings longer than 12 characters.
Search for "GNU".
Search for "help".
Count extracted strings.
Display hexadecimal offsets.
Display unique strings.

Best Practices¶

Use strings as a first step when analyzing unknown binaries.
Combine with grep to locate specific indicators.
Avoid executing unknown files during initial analysis.
Verify findings using additional tools such as file, readelf, or objdump.
Document interesting findings during investigations.

Common Mistakes¶

❌ Assuming every extracted string is meaningful.

✅ Some strings may be unrelated data or compiler-generated content.

❌ Treating strings output as proof of malicious behavior.

✅ The presence of a URL or command does not necessarily indicate malicious activity.

❌ Ignoring string length.

✅ Using -n can reduce noise and highlight more useful information.

Interview Questions¶

Beginner¶

What does the strings command do?
Does strings execute a binary?
What does the -n option specify?
How do you search extracted strings for URLs?

Intermediate¶

Why is strings useful in malware analysis?
Explain the purpose of -t x.
How would you identify hardcoded configuration values?
What are the limitations of strings?

Architect Level¶

How would you perform an initial investigation of an unknown executable?
Why should strings be combined with tools like file, readelf, and objdump?
How would you automate binary inspection across hundreds of servers?

Summary¶

In this lesson, you learned:

Extracting printable text from binaries
Filtering strings by length
Displaying offsets
Searching for URLs, IPs, passwords, and configuration files
Using strings in security investigations
Combining strings with other Linux commands

The strings command is a simple yet powerful utility for examining binary files without executing them. It plays an important role in Linux administration, software debugging, and cybersecurity investigations.

Key Takeaways¶

strings extracts printable text from binary files.
It does not execute the target file.
Use -n to control the minimum string length.
Use -t to display offsets.
Combine strings with grep, sort, and wc for efficient analysis.
strings is a valuable first step in binary inspection and malware triage.

What's Next?¶

tee Command — Writing Output to Both Screen and File

In the next lesson, you'll learn:

Saving command output while displaying it
Appending to files
Logging automation output
Using tee in pipelines
Real-world DevOps and CI/CD use cases