1 Look Around
More
Interesting dirs
/var/backup
/var/www/classes/
/home/bob/
/export
/var/logs
/tmp
/home/bob/.*history
/backups
/var/mail
/var/tmp
/anythingweird
/.ssh
/reports
/private
Searching Linux
--------------------
--------------------
Linux Version
>> lsb_release -a
--------------------
--------------------
Search for File inside Multiple Directories
> find /home -name .bash_history
/home/victim15/.bash_history
--------------------
--------------------
wildcards
find -name '*db*'
find -name '*.GIF'
find -iname '*.gif'
find -iname \*.gif
--------------------
--------------------
Search for a Keyword inside multiple files:
>> find /home -name .bashrc
>> find /home -name .bashrc -exec grep password {} \;
>> find . -name .bashrc -exec grep -H password {} \; ..show the folder too
Find > cat > grep
>> find . -name .bashrc -exec cat {} \; | grep key
>> find /home/file.txt -exec cat {}\;
--------------------
--------------------
> find . -name .zsh_history
> cat ./victim54/.zsh_history
> find . -name .zsh_history -exec cat {} \; | grep "key"
--------------------
--------------------
Grep a directory for user/pws:
grep -Ri password .
grep -Ri 'mark\|tom\|rastating\|password' * | head
-R: — Dereference-recursive
-i: — Ignore-case
head: — Display first 10 lines
--------------------
--------------------
Unusual Home Directories
> cat /etc/passwd
--------------------
--------------------
Check every profile for history 'passwd'
> find /home -name .bash_history -exec grep -A 1 '^passwd' {} \;
--------------------
--------------------
Search for Secrets in files
strings * grep / ..to find a single /
strings * grep '\\' ..to find a single \
strings * -n 8
strings * -e b
strings * -e l
exiftool * | grep firewall
exiftool * | grep firewall
exiftool * | grep /
exiftool * | grep '\\'
--------------------
--------------------
locate myapp
updatedb ..if my app wasnt in the index yet
find / -name whoami
find / -name ls ..very slow
find / -name ls & ..spawn (jobs bg fg1)
grep root * ..look for word 'root' in my current directory
---------------------------------------
---------------------------------------
Watch bad login attempts:
sudo tail -f /var/log/auth.log
---------------------------------------
---------------------------------------
Search for a string with 32 Digits
grep -e '[^\ ]\{32,\}' -rl /tmp/pacman/gitdir3
---------------------------------------
---------------------------------------
cat .hidden
cat 'spaces in filename'
cat data.txt | grep millionth
more myfile
file myfile
find / -user bandit
find / -user bandit 2>&1 | grep -v "Permission denied"
find / -user bandit -type f -name "pass" -print 2>/dev/null
find / -user bandit -type f -group bandit6 -size 33c -exec ls {} \;
find / -user bandit -group bandit6 -size 33c 2>&1 | grep -F -v Permission
find / -user bandit | grep -v "pass" 2>&1 | grep -v "Permission denied"
find / -user bandit -type f -print 2>/dev/null
find / -user bandit -type f "pass" -print 2>/dev/null
sort data.txt
sort data.txt | uniq -c ..counter
sort data.txt | uniq -u ..unique only
strings data.txt | sort
strings data.txt | grep "=="Linux Services
json obfuscated
On screen data might be obfuscated, but there are other ways to find it!
Linux SUID and Privs
Network Checks
Linux Unzipping
Admin crons
REF: procmon
Impersonate
sed tricks
Text Cleanup
Set every comma as a new line
Last updated
Was this helpful?