sed — Stream Editor (Find & Replace)
What is sed?
sed transforms text line-by-line: substitute strings, delete lines, insert text. Often used in pipelines to clean or reformat output.
OSCP use: Strip trailing commas from port lists, remove blank lines, replace strings in configs, extract patterns from logs.
Syntax
sed 'COMMAND' file
sed -i 'COMMAND' file # edit file in place
command | sed 'COMMAND'📌 Common Commands
| Command | Description |
|---|---|
s/OLD/NEW/ | Substitute first match per line |
s/OLD/NEW/g | Substitute all matches per line |
s/OLD/NEW/gi | Global + case insensitive |
d | Delete matching lines |
p | Print line (with -n) |
N | Append next line |
📌 Common Flags
| Flag | Description |
|---|---|
-i | Edit file in place (add .bak for backup: -i.bak) |
-n | Suppress auto-print (use with p) |
-E / -r | Extended regex |
-e CMD | Multiple commands |
📌 Substitute Examples
# Replace first occurrence per line
sed 's/password/passwd/' config.txt
# Replace all occurrences
sed 's/http/https/g' urls.txt
# Case insensitive
sed 's/Password/SECRET/gi' file.txt
# In-place edit (careful!)
sed -i 's/old/new/g' file.txt
sed -i.bak 's/old/new/g' file.txt # keeps backup
# From pipe
echo "hello world" | sed 's/world/OSCP/'📌 Delete / Filter Lines
# Delete blank lines
sed '/^$/d' file.txt
# Delete lines containing pattern
sed '/debug/d' log.txt
# Delete lines 1-5
sed '1,5d' file.txt
# Print only matching lines
sed -n '/error/p' log.txt📌 OSCP Examples
# Nmap — build comma-separated port list, remove trailing comma
grep "^[0-9]" ports.txt | cut -d'/' -f1 | tr '\n' ',' | sed 's/,$//'
# Remove Windows carriage returns
sed -i 's/\r$//' file.txt
# Extract IP from line (basic)
sed -n 's/.*\([0-9]\{1,3\}\(\.[0-9]\{1,3\}\)\{3\}\).*/\1/p' log.txt📌 Quick Cheat Sheet
sed 's/find/replace/g' file.txt
sed -i 's/find/replace/g' file.txt
sed '/pattern/d' file.txt # delete matching lines
sed '/^$/d' file.txt # delete blank lines
sed -n '5p' file.txt # print line 5 only
cat file | sed 's/old/new/g'