Ravindra BagaleCourses & study guides

6. Linux Advanced Commands

6.2 Finding Files: find

By Last updated: 

find /var/www -name "*.html"                 # by name
find / -iname "nginx.conf" 2>/dev/null       # case-insensitive, hide permission errors
find /var/log -type f -size +100M            # files bigger than 100 MB
find /tmp -type f -mtime +7                  # modified more than 7 days ago
find /tmp -type f -mtime +7 -delete          # ...and delete them
find /var/www/html -type d -exec chmod 755 {} \;   # run a command on each result
find . -type f -name "*.log" | xargs ls -lh

find / -perm -o+w -type f 2>/dev/null | grep -v /proc     # world-writable files
find /var/www -name "*.php" -mmin -60                      # PHP files changed in last hour
find / -name "id_rsa*" 2>/dev/null                         # stray private keys

Why this matters for security

Attackers use find to hunt for SUID binaries, writable files and keys. Incident responders use -mmin/-mtime to find web shells and files changed around the time of an attack.

Ravindra Bagale's Tip

Don't run find ... -delete or -exec rm directly. Many students have wiped the wrong folder. First run it without -delete, look at the list, and add -delete only once you're sure.

Practice task

Find all .conf files under /etc modified in the last 7 days, and all files larger than 50 MB anywhere on the system.