# How to change magic numbers

&#x20;let's use the Linux `file` command to check the file type of our shell:<br>

<figure><img src="https://859957243-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fde5Oj59jxsVsTZcMyIgC%2Fuploads%2F0Nr3FH3ckpw9DqGJgOO0%2Fimage.png?alt=media&#x26;token=67462776-dc99-487a-a154-d109635e53de" alt=""><figcaption></figcaption></figure>

As expected, the command tells us that the filetype is PHP. Keep this in mind as we proceed with the explanation.<br>

We can see that the magic number we've chosen is four bytes long, so let's open up the reverse shell script and add four random characters on the first line. These characters do not matter, so for this example we'll just use four "A"s:

<figure><img src="https://859957243-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fde5Oj59jxsVsTZcMyIgC%2Fuploads%2FAf5AocXBDTjbidc6rtg4%2Fimage.png?alt=media&#x26;token=bfa317e2-d986-493d-85cc-99c657453cc8" alt=""><figcaption></figcaption></figure>

Save the file and exit. Next we're going to reopen the file in `hexeditor` (which comes by default on Kali), or any other tool which allows you to see and edit the shell as hex. In hexeditor the file looks like this:

<figure><img src="https://859957243-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fde5Oj59jxsVsTZcMyIgC%2Fuploads%2FxSxWfPa9XJX744nnWeMi%2Fimage.png?alt=media&#x26;token=a3368ef0-3fb5-425e-9eb1-f26a6100b6c0" alt=""><figcaption></figcaption></figure>

Note the four bytes in the red box: they are all `41`, which is the hex code for a capital "A" -- exactly what we added at the top of the file previously.

Change this to the magic number we found earlier for JPEG files: `FF D8 FF DB`

<figure><img src="https://859957243-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fde5Oj59jxsVsTZcMyIgC%2Fuploads%2FTxryWA0IzUW6ZAmaJhY1%2Fimage.png?alt=media&#x26;token=b267504e-e0e3-4f4f-8e07-bdb0897e16a4" alt=""><figcaption></figcaption></figure>

Now if we save and exit the file (Ctrl + x), we can use `file` once again, and see that we have successfully spoofed the filetype of our shell:

<figure><img src="https://859957243-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fde5Oj59jxsVsTZcMyIgC%2Fuploads%2FHU3if3kjmVBMESLuAHp3%2Fimage.png?alt=media&#x26;token=fe259a53-57be-4532-8a57-2d3b2d342ed8" alt=""><figcaption></figcaption></figure>
