Learn / Linux Fundamentals / Working with Linux

Finding Things

guidedeasy 30 min · 110 points

First Bit is still up for grabs: be the first to finish this room.

Sooner or later you'll need a file and have no idea where it is: a config file somebody moved, a log that's filling the disk, or something an attacker left behind. find can search by almost anything a file has (its name, size, owner, permissions, age), and grep -r searches inside files.

This room teaches both, and then drops you into Finn's haystack: hundreds of files in dozens of folders, and one of them doesn't belong.

CYB//RANGE Live lab

Task 1 Finding files by name

find walks through a folder and everything under it, printing whatever matches your tests:

$ find ~/haystack -name "notes.txt"
$ find ~/haystack -name "*.conf"
$ find /etc -iname "*SSH*"

The first argument is where to start. . means "here".
-name matches the file name. Put wildcards in quotes, or the shell expands them before find sees them.
-iname does the same, ignoring upper and lower case.

-type narrows it to one kind of thing: f for regular files and d for directories.

$ find ~/haystack -type d -name "*-0*"

With no tests at all, find ~/haystack simply lists everything under that folder, which, piped into wc -l, tells you how many there are.

Which find test matches a name while ignoring upper and lower case?

******

What goes after -type to find only directories?

*

Task 2 Finding by size, owner and age

Names are only the start. Some more tests:

Test	Matches	Example
`-size +1M`	bigger than 1 MB (`-` for smaller; `k`, `M`, `G`)	`find / -size +500M`
`-user NAME`	owned by that user	`find /home -user root`
`-group NAME`	belonging to that group	`find /srv -group auditors`
`-mtime -N`	modified in the last N days (`+N` for longer ago)	`find /etc -mtime -1`
`-mmin -N`	the same in minutes	`find /tmp -mmin -30`
`-perm -o+w`	writable by everyone	`find / -perm -o+w -type f`

Tests combine: all of them must match.

$ find /var/log -type f -size +10M -mtime -7

That's "log files over 10 MB changed this week": a good first question when a disk fills up.

Searching folders you aren't allowed into prints a "Permission denied" line for each one. Those messages go to the error stream, so 2>/dev/null throws them away and leaves only the results:

$ find / -name "*.conf" 2>/dev/null

Which find test matches files owned by a particular user?

*****

-mtime -1 matches files modified within the last how many days?

*

What do you add to a find command to throw away its "Permission denied" messages?

**/***/****

Task 3 Searching inside files, and finding programs

find looks at files from the outside. To search what's inside them, use grep -r (from the Reading Files room). Add -l to get just the names of the files that match:

$ grep -rl "password" ~/haystack

Two more finders worth knowing:

which shows the full path of the program a command runs. It searches the folders in your PATH:
```
$ which ls
/usr/bin/ls
```
locate finds names almost instantly from a prebuilt database. It's handy, but it only knows what was there at the last database update, and it isn't installed everywhere. find always sees the system as it is right now.

Which grep option prints only the names of the files that match, not the lines?

**

Which command shows the full path of the program that a command name runs?

*****

Task 4 Try it on a real machine

Finn's ~/haystack holds hundreds of files in about forty folders, all untouched for months. When your lab starts, one new file appears somewhere in it.

Press Launch in CybRange at the top of this page, then Open terminal next to box once it's ready. You're logged in as finn.
Get a feel for it: ls ~/haystack, then find ~/haystack -type f | wc -l.
Answer the questions below with find tests: by name, by owner, by size, and by age.

Tip: hidden folders (names starting with .) don't show in a plain ls, but find searches them too.

How many files in ~/haystack have names ending in .conf?

***

How many files in ~/haystack are owned by root?

*

Only one file in ~/haystack is bigger than 1 MB. What is its name (just the name, no folder)?

***************

Everything in ~/haystack is months old except one file, which appeared when your lab started. What flag is in it?

RZ{************************}