> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/linux-discovery/linux-file-enumeration.md).
# Linux File Enumeration
## Locate flag files
Locate flag files with the `find` command
```bash
find / -type f -name [Ff]lag* 2>/dev/null
```
```bash
find /home -type f -name [Uu]ser* 2>/dev/null
```
## Locate SUID files
Locate SUID files
```bash
find / -type f -perm /4000
```
Locate SGID files
```bash
find / -type f -perm /2000
```
Locate SUID or SGID files
```bash
find / -type f -perm /6000
```
### Find permission help
File permission help, excerpt from man page for `find`
```
-perm mode
File's permission bits are exactly mode (octal or symbolic). Since an
exact match is required, if you want to use this form for symbolic modes,
you may have to specify a rather complex mode string. For example
`-perm g=w' will only match files which have mode 0020 (that is, ones
for which group write permission is the only permission set). It is more
likely that you will want to use the `/' or `-' forms, for example
`-perm -g=w', which matches any file with group write permission.
-perm -mode
All of the permission bits mode are set for the file. Symbolic modes
are accepted in this form, and this is usually the way in which you
would want to use them. You must specify `u', `g' or `o' if you use
a symbolic mode.
-perm /mode
Any of the permission bits mode are set for the file. Symbolic modes
are accepted in this form. You must specify `u', `g' or `o' if you use
a symbolic mode. If no permission bits in mode are set, this test
matches any file (the idea here is to be consistent with the behaviour
of -perm -000).
-perm +mode
This is no longer supported (and has been deprecated since 2005). Use
-perm /mode instead.
```
## Locate hidden files
To locate hidden (dot files)
```bash
find /home -type f -name ".*" 2>/dev/null
```
## Other examples
Find files owned by a certain user
```bash
find / -type f -user 502 2>/dev/null
```
Find files owned by a certain group
```bash
find / -type f -group best-group 2>/dev/null
```
## Usage information
find -perm parameters
```
-perm mode
File's permission bits are exactly mode (octal or
symbolic). Since an exact match is required, if you want
to use this form for symbolic modes, you may have to
specify a rather complex mode string. For example `-perm
g=w' will only match files which have mode 0020 (that is,
ones for which group write permission is the only
permission set). It is more likely that you will want to
use the `/' or `-' forms, for example `-perm -g=w', which
matches any file with group write permission. See the
EXAMPLES section for some illustrative examples.
-perm -mode
All of the permission bits mode are set for the file.
Symbolic modes are accepted in this form, and this is
usually the way in which you would want to use them. You
must specify `u', `g' or `o' if you use a symbolic mode.
See the EXAMPLES section for some illustrative examples.
-perm /mode
Any of the permission bits mode are set for the file.
Symbolic modes are accepted in this form. You must
specify `u', `g' or `o' if you use a symbolic mode. See
the EXAMPLES section for some illustrative examples. If
no permission bits in mode are set, this test matches any
file (the idea here is to be consistent with the behaviour
of -perm -000).
-perm +mode
This is no longer supported (and has been deprecated since
2005). Use -perm /mode instead.
```
find --help
```
┌──(kali㉿kali)-[~/Desktop]
└─$ find --help
Usage: find [-H] [-L] [-P] [-Olevel] [-D debugopts] [path...] [expression]
Default path is the current directory; default expression is -print.
Expression may consist of: operators, options, tests, and actions.
Operators (decreasing precedence; -and is implicit where no others are given):
( EXPR ) ! EXPR -not EXPR EXPR1 -a EXPR2 EXPR1 -and EXPR2
EXPR1 -o EXPR2 EXPR1 -or EXPR2 EXPR1 , EXPR2
Positional options (always true):
-daystart -follow -nowarn -regextype -warn
Normal options (always true, specified before other expressions):
-depth -files0-from FILE -maxdepth LEVELS -mindepth LEVELS
-mount -noleaf -xdev -ignore_readdir_race -noignore_readdir_race
Tests (N can be +N or -N or N):
-amin N -anewer FILE -atime N -cmin N -cnewer FILE -context CONTEXT
-ctime N -empty -false -fstype TYPE -gid N -group NAME -ilname PATTERN
-iname PATTERN -inum N -iwholename PATTERN -iregex PATTERN
-links N -lname PATTERN -mmin N -mtime N -name PATTERN -newer FILE
-nouser -nogroup -path PATTERN -perm [-/]MODE -regex PATTERN
-readable -writable -executable
-wholename PATTERN -size N[bcwkMG] -true -type [bcdpflsD] -uid N
-used N -user NAME -xtype [bcdpfls]
Actions:
-delete -print0 -printf FORMAT -fprintf FILE FORMAT -print
-fprint0 FILE -fprint FILE -ls -fls FILE -prune -quit
-exec COMMAND ; -exec COMMAND {} + -ok COMMAND ;
-execdir COMMAND ; -execdir COMMAND {} + -okdir COMMAND ;
Other common options:
--help display this help and exit
--version output version information and exit
Valid arguments for -D:
exec, opt, rates, search, stat, time, tree, all, help
Use '-D help' for a description of the options, or see find(1)
Please see also the documentation at https://www.gnu.org/software/findutils/.
You can report (and track progress on fixing) bugs in the "find"
program via the GNU findutils bug-reporting page at
https://savannah.gnu.org/bugs/?group=findutils or, if
you have no web access, by sending email to .
```
## References
find - Linux manual page: