Bash

Finding Files

Search /PATH/TO/DIRECTORY for files of the type “FILE-FILTER” (e.g. *.txt) that contain the “STRING”, displaying the line of the file with “STRING” and the file name.

Find password files, database connection strings, encryption keys, and a many other useful items during post exploitation.

find /PATH/TO/DIRECTORY -name "FILE-FILTER" -type f -exec grep -i "STRING" {} \\; -print 2>/dev/null

Find hidden files, on macOS and delete them.

find /PATH/TO/DIRECTORY -type f -name "._*" -exec rm -v {} \\;

Kill Processes Cleanly

Find processes and terminate them, without displaying errors if they cannot be deleted.

Search for processes containing string and terminate it cleanly, without showing errors.

ps aux | grep 'slack' | awk '{print $2}' | xargs kill 2>/dev/null

Find source of user authentications

Find which user have authenticated and from which hosts (IP addresses).

Search for log entries mentioning user logins and then identify IP addresses - sort the unique results.

grep -n -E 'User.*logged in.*from' *.log | grep -Eo '((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)' | sort -u