find — Search the Filesystem
What is find?
find walks directory trees and returns files/directories matching your criteria — by name, type, permissions, owner, size, or modification time.
OSCP use: Find SUID binaries, writable scripts, config files,
.gitfolders, SSH keys, and pass results togreporxargs.
Syntax
find [PATH...] [EXPRESSION]
find / -name "*.conf" 2>/dev/null📌 Common Tests (Expressions)
| Expression | Description |
|---|---|
-name PATTERN | Filename (case-sensitive glob) |
-iname PATTERN | Filename (case-insensitive) |
-type f | Regular files only |
-type d | Directories only |
-perm -4000 | SUID files |
-perm -2000 | SGID files |
-perm -002 | World-writable |
-writable | Writable by current user |
-user NAME | Owned by user |
-group NAME | Owned by group |
-size +N | Larger than N (c=bytes, k=KB, M=MB) |
-mtime -N | Modified within last N days |
-maxdepth N | Limit search depth |
-mindepth N | Minimum depth |
-empty | Empty files/dirs |
-exec CMD {} \; | Run command on each result |
-exec CMD {} + | Run command with multiple files (faster) |
Combine with -and / -or / -not:
find / -name "*.php" -and -writable 2>/dev/null
find / \( -name "*.conf" -o -name "*.config" \) 2>/dev/null📌 Basic Usage
# By name
find / -name "flag.txt" 2>/dev/null
find / -name "*.conf" 2>/dev/null
find / -iname "*password*" 2>/dev/null
# By type
find /var/www -type f -name "*.php"
find / -type d -name ".git" 2>/dev/null
# Limit depth (faster)
find / -maxdepth 3 -name "*.txt" 2>/dev/null📌 PrivEsc — High-Value Finds
# SUID binaries
find / -perm -4000 -type f 2>/dev/null
# SGID
find / -perm -2000 -type f 2>/dev/null
# World-writable files
find / -writable -type f 2>/dev/null | grep -v proc
# Writable directories
find / -writable -type d 2>/dev/null | grep -v proc
# Writable by root-owned paths
find / -writable -user root -type f 2>/dev/null
# SSH keys
find / -name "id_rsa" -o -name "id_ed25519" 2>/dev/null
# Config / cred files
find / -name "*.conf" -o -name "*.config" -o -name "*.xml" 2>/dev/null
find /home -name ".bash_history" 2>/dev/null📌 Chaining with xargs / grep
# Grep every .conf file for passwords
find / -name "*.conf" 2>/dev/null | xargs grep -l "password" 2>/dev/null
# Run file command on all SUID binaries
find / -perm -4000 -type f 2>/dev/null | xargs ls -la
# Execute command on each match
find /tmp -name "*.sh" -exec chmod +x {} \;
find . -name "*.txt" -exec cat {} \;📌 Quick Cheat Sheet
find / -name "filename" 2>/dev/null
find / -name "*.php" 2>/dev/null
find / -perm -4000 -type f 2>/dev/null # SUID
find / -writable -type f 2>/dev/null
find / -maxdepth 4 -name "*.conf" 2>/dev/null
find / -name "*.conf" 2>/dev/null | xargs grep -l "pass" 2>/dev/nullAlways redirect stderr:
2>/dev/nullhides permission-denied noise.