Find files by name (case-insensitive)

find /home -iname “*.conf” -type f

> [!info]+ Command Breakdown
> 1. **-iname "*.conf"**: Case-insensitive pattern matching for files ending in `.conf`
> 2. **-type f**: Restricts results to regular files only
> 3. *Wildcard `*` matches any characters before `.conf` extension*
> 4. *Useful for locating configuration files across user directories*

```bash
# Find files larger than 100MB
find / -type f -size +100M 2>/dev/null

[!info]+ Command Breakdown

1. -size +100M: Files greater than 100 megabytes
2. 2>/dev/null: Redirects permission-denied errors to avoid output clutter
3. Starting from root / requires elevated privileges for complete results
4. Useful for identifying large files consuming disk space or potential data exfiltration

# Find files modified between two dates
find /data -newermt "2025-12-01" ! -newermt "2026-01-01"

[!info]+ Command Breakdown

1. -newermt “2025-12-01”: Files modified after (newer than) December 1, 2025
2. ! -newermt “2026-01-01”: ! negates the test; files NOT newer than January 1, 2026
3. Logical combination creates a date range: December 1-31, 2025
4. Critical for incident response timeline analysis

# Find and delete empty directories
find /tmp -type d -empty -delete

[!warning]+ Command Breakdown

1. -type d: Targets directories only
2. -empty: Matches directories with no contents
3. -delete: Deletes matched items (implies -depth traversal)
4. Use with extreme caution—deletion is immediate and irreversible
5. Test with -print before using -delete to verify targets

SUID/SGID and World-Writable File Discovery

Files with SUID/SGID bits or world-writable permissions are high-value targets for privilege escalation:

1. SUID (Set User ID): Executes with file owner’s privileges (typically root)
2. SGID (Set Group ID): Executes with file group’s privileges
3. World-writable: Any user can modify the file
4. Cross-reference SUID binaries with GTFOBins for exploitation paths
5. World-writable config files in /etc are critical escalation vectors

SUID/SGID Discovery Commands

# Find SUID files
find / -type f -perm -4000 2>/dev/null

[!info]+ Command Breakdown

1. -perm -4000: Files with at least the SUID bit (octal 4000) set
2. -type f: Restricts to regular files (not directories)
3. The - prefix means “at least these permission bits”—file may have additional permissions
4. Common legitimate SUID binaries: /usr/bin/passwd, /usr/bin/sudo, /bin/ping

# Find SGID files
find / -type f -perm -2000 2>/dev/null

SGID characteristics:

1. SGID on executables runs with group privileges
2. SGID on directories causes new files to inherit directory’s group
3. Less common for privilege escalation than SUID but still valuable
4. Check output against system baseline for anomalies

# Find SUID or SGID files
find / -type f \( -perm -4000 -o -perm -2000 \) 2>/dev/null

[!info]+ Command Breakdown

1. ( … ): Parentheses create logical grouping (escaped for shell)
2. -o: Logical OR operator—matches either condition
3. Comprehensive search for all elevated permission binaries
4. Output should be compared against baseline for anomaly detection

World-Writable Discovery Commands

# Find world-writable files
find / -type f -perm -0002 2>/dev/null

Security implications:

1. Extremely dangerous if file is executed or sourced by privileged processes
2. Check ownership—writable files owned by root are highest priority
3. Common in web directories due to misconfigurations
4. Potential for code injection or configuration tampering

# Find world-writable directories (sticky bit often expected)
find / -type d -perm -0002 2>/dev/null

Expected vs. dangerous:

1. World-writable directories like /tmp typically have sticky bit (1000) set
2. Sticky bit prevents users from deleting others’ files
3. Missing sticky bit on writable directory is a misconfiguration
4. Check /var/www, /var/tmp, /dev/shm for anomalies

Advanced Privilege Escalation Enumeration

# SUID binaries owned by root (common priv-esc targets)
find / -type f -perm -4000 -user root 2>/dev/null

Analysis approach:

1. Root-owned SUID binaries execute with root privileges
2. Focus on non-standard binaries not in /usr/bin or /bin
3. Test discovered binaries against GTFOBins for known exploits
4. Document custom SUID binaries for deeper analysis

# SUID/SGID with detailed output
find / -type f \( -perm -4000 -o -perm -2000 \) -exec ls -la {} \; 2>/dev/null

[!info]+ Command Breakdown

1. -exec ls -la {} ;: Executes ls -la on each matched file
2. {}: Placeholder replaced with found filename
3. ;: Required terminator for -exec (escaped for shell)
4. Provides full permission string, owner, group, size, and modification date

# World-writable files excluding /proc and /sys
find / -path /proc -prune -o -path /sys -prune -o -type f -perm -0002 -print 2>/dev/null

[!info]+ Command Breakdown

1. -path /proc -prune: Excludes /proc directory from traversal
2. -o: OR operator—chains pruning and search logic
3. -prune: Prevents descending into matched directory
4. /proc and /sys are pseudo-filesystems with world-writable entries by design
5. Excluding them reduces noise and improves performance

# World-writable directories without sticky bit (dangerous)
find / -type d \( -perm -0002 -a ! -perm -1000 \) 2>/dev/null

[!danger]+ Command Breakdown

1. -a: Logical AND operator—both conditions must be true
2. ! -perm -1000: Negates sticky bit check (octal 1000)
3. World-writable directory without sticky bit allows any user to delete any file
4. Severe misconfiguration—often found in poorly configured web directories

OPSEC considerations:

1. Full system scans generate high I/O and may trigger file integrity monitoring (AIDE, OSSEC)
2. Redirect stderr (2>/dev/null) to avoid logging permission-denied paths in shell history
3. Consider running during high-activity periods to blend with baseline noise
4. Use -maxdepth to limit scope and reduce detection surface
5. Combine with -xdev to avoid traversing network mounts (reduces latency and external logs)

Command Execution with -exec and xargs

Three primary methods exist for executing commands on found files, each with distinct performance and safety characteristics:

1. -exec cmd {} ;: Forks command once per file (slower, more visible)
2. -exec cmd {} +: Batches files into single command invocation (faster, less visible)
3. find | xargs: Batches via pipe, respects ARG_MAX, supports parallelism

Execution Method Comparison

-exec Examples

# -exec with \; (one command per file – slower)
find . -type f -name "*.log" -exec rm {} \;

[!info]+ Command Breakdown

1. -exec rm {}: Executes rm command with {} replaced by filename
2. ;: Terminator indicating end of command (backslash escapes semicolon from shell)
3. Spawns one rm process per file—thousands of files = thousands of processes
4. High overhead but allows per-file command customization

# -exec with + (batched arguments – faster)
find . -type f -name "*.log" -exec rm {} +

Batching behaviour:

1. Combines multiple filenames into single command invocation
2. Example: rm file1.log file2.log file3.log instead of three separate rm calls
3. Respects system ARG_MAX limit—automatically splits into multiple batches if needed
4. Preferred method for large-scale operations

# Grep for pattern in PHP files (batched)
find /var/www -type f -name "*.php" -exec grep -l "eval(" {} +

[!info]+ Command Breakdown

1. grep -l “eval(”: Lists filenames containing the string eval( (potential web shell indicator)
2. -exec … +: Batches PHP files into single grep invocation for efficiency
3. Useful for web application security audits and malware hunting
4. Consider escaping parentheses in grep pattern depending on shell context

# Change ownership in batches
find /data -type f -exec chown appuser:appgroup {} +

Performance notes:

1. Changes file owner to appuser and group to appgroup
2. Batching significantly reduces execution time on large directory trees
3. Common post-deployment task or privilege management operation
4. Requires appropriate permissions (typically root/sudo)

xargs Examples

# Pipe to xargs (batched, handles large sets)
find . -type f -name "*.log" -print0 | xargs -0 rm

[!info]+ Command Breakdown

1. -print0: Outputs null-delimited filenames (handles spaces, newlines, special characters)
2. xargs -0: Reads null-delimited input from stdin
3. The -0 pairing is critical for safe handling of unusual filenames
4. xargs automatically batches arguments respecting ARG_MAX

# xargs with parallelism
find . -type f -name "*.log" -print0 | xargs -0 -P 4 rm

Parallelism considerations:

1. -P 4: Runs up to 4 parallel rm processes simultaneously
2. Significantly faster for CPU-bound operations (compression, checksumming)
3. Use -P 1 to force serial execution if parallelism causes detection
4. Monitor system load—excessive parallelism can overwhelm resources

# Safe delete with confirmation (interactive)
find . -name "*.tmp" -print0 | xargs -0 -p rm

Interactive mode:

1. -p: Prompts user before executing each command
2. Safety mechanism for destructive operations
3. User must type y to confirm each deletion
4. Not suitable for automated scripts—use only for manual operations

# Compress logs older than 30 days (parallel)
find /var/log -type f -mtime +30 -name "*.log" -print0 | xargs -0 -P 4 gzip

[!info]+ Command Breakdown

1. -mtime +30: Files modified more than 30 days ago
2. gzip: Compresses each file (replaces original with .gz version)
3. -P 4: Compresses 4 files simultaneously
4. Common log rotation cleanup task
5. Parallelism ideal for CPU-intensive compression workloads

Additional xargs Options

[!warning]+ Common Errors

1. Missing -0 with xargs when filenames contain spaces: Command breaks or acts on wrong files—always use -print0 | xargs -0 pairing
2. Forgetting \; or + at end of -exec: Syntax error—required terminator
3. Using -delete before other predicates: Evaluation order matters; -delete implies -depth traversal
4. Forgetting -r with xargs when find returns nothing: Unexpected command execution with no arguments
5. Exceeding ARG_MAX with -exec {} +: Rare on modern systems—xargs auto-splits, but find may fail on ancient systems

Time-Based File Searches

find supports three timestamp types for file matching:

1. mtime: File modification time (content changed)
2. atime: File access time (content read)
3. ctime: Inode change time (metadata changed—permissions, ownership, name)
4. Each has day-based (-mtime) and minute-based (-mmin) variants
5. Critical for incident response, forensic analysis, and log management

Time Predicate Syntax

Time-Based Search Examples

# Files modified in the last 24 hours
find /var/log -type f -mtime 0

Interpretation:

1. -mtime 0: Files modified between now and 24 hours ago
2. 0 represents the current 24-hour period from now
3. Useful for identifying recently changed logs during incident investigation
4. Does not mean “modified today”—use -daystart -mtime 0 for that

# Files modified more than 30 days ago
find /tmp -type f -mtime +30

Interpretation:

1. -mtime +30: Files with modification time older than 30 days
2. + prefix means “more than”—excludes files at exactly 30 days
3. Common cleanup pattern for temporary directories
4. Combine with -delete or -exec rm for automated maintenance

# Files modified in the last 60 minutes
find /home -type f -mmin -60

Interpretation:

1. -mmin -60: Files modified within the last 60 minutes
2. - prefix means “less than”—within the specified timeframe
3. Higher resolution than day-based predicates
4. Essential for real-time security monitoring and breach detection

# Files modified yesterday (using -daystart)
find /data -daystart -mtime 1 -type f

[!info]+ Command Breakdown

1. -daystart: Changes reference point to midnight today (00:00) instead of current time
2. -mtime 1: Exactly 1 day ago from reference point
3. Without -daystart, 1 means “24-48 hours ago from now”
4. Order matters: -daystart must appear before -mtime in expression

# Files modified between two dates
find /logs -newermt "2025-12-01" ! -newermt "2025-12-31"

[!info]+ Command Breakdown

1. -newermt “2025-12-01”: Modified after (newer than) December 1, 2025 00:00:00
2. ! -newermt “2025-12-31”: ! negates—NOT newer than December 31, 2025 00:00:00
3. Creates inclusive date range: December 1-30, 2025
4. Requires quotes around dates; supports ISO 8601 format with time: "2025-12-01 14:30:00"

# Files accessed more recently than a reference file
find /app -newer /app/deploy.timestamp

Use cases:

1. -newer /app/deploy.timestamp: Files modified more recently than reference file’s mtime
2. Useful for identifying files changed since last deployment
3. Create timestamp files with touch to mark events
4. Variant: -anewer for atime comparison, -cnewer for ctime

Advanced Time-Based Queries

# Files modified today (calendar day, not 24 hours)
find /var/log -type f -daystart -mtime 0 -printf "%T+ %p\n"

[!info]+ Command Breakdown

1. -daystart -mtime 0: Files modified since midnight today
2. -printf “%T+ %p\n”: Custom format—%T+ is ISO timestamp, %p is path
3. Output format: 2026-01-18+09:30:15.0000000000 /var/log/auth.log
4. Pipe to sort for chronological ordering

# Files NOT accessed in the last 90 days (candidates for archival)
find /archive -type f -atime +90 -ls

Archival workflow:

1. -atime +90: Access time older than 90 days
2. -ls: Long listing output with timestamps
3. Identifies stale files for archival or deletion
4. Warning: atime may be unreliable on filesystems with noatime or relatime mount options

OPSEC and forensic considerations:

1. Access time queries may update atime on some filesystems: Recursive find can modify the evidence you’re searching for
2. noatime or relatime mount options: Access time may be stale or not updated—verify mount options with mount | grep atime
3. Timestomping: Adversaries can modify file timestamps—time-based queries less reliable if attacker has touched files
4. Timezone considerations: Timestamps in UTC vs local time—use %T+ printf format for ISO 8601 with timezone
5. Inode change time (ctime) cannot be modified by standard tools: More forensically reliable than mtime/atime

[!tip]+ Performance Optimization

1. Combine time predicates with -type early in expression for faster evaluation
2. Use -maxdepth to limit search scope when possible
3. Redirect stderr (2>/dev/null) to avoid permission-denied overhead
4. Consider locate database for name-based searches if time constraints allow
5. Use -xdev to avoid crossing mount points and network filesystems

References

1. GNU findutils Manual
2. Linux find Man Page
3. Red Hat: Linux find Command
4. Cyberciti: Finding Files by Date
5. Red Hat: Audit Permissions with find
6. Baeldung: Find Modified Date
7. Endpoint Dev: Efficiency of find -exec vs xargs
8. CaveOps: find -exec vs find | xargs
9. GTFOBins
10. MITRE ATT&CK: File and Directory Discovery
11. HackTricks: Linux Privilege Escalation
12. SANS: Incident Response Process

#Linux #FileSystemEnumeration #find #xargs #SUID #SGID #PrivilegeEscalation #IncidentResponse #Forensics #SystemAdministration #PenetrationTesting #Reconnaissance #GTFOBins