E-FIN
find
Walk a filesystem and match files by name, type, or permission — the usual loot search on Linux.
OVERVIEW
GNU find (gnu.org/software/findutils) walks a directory tree and prints paths that match tests: name, type, size, mtime, or mode. On a foothold it is how you look for leftover `.env` files, SSH keys, world-writable scripts, and SUID binaries without installing a privesc helper.
Start from a narrow root (`/var/www`, `/home`, `/opt`) rather than `/`. Redirect stderr so permission errors do not bury hits. `-readable` / `-perm` filters and `-mtime` keep the result set small enough to review. Pair with `ls` or `file` on the hits before opening anything that looks like a secret.
USE CASES
Practical use cases
- 01
Hunting application config and `.env` files under a web root.
- 02
Listing SUID/SGID binaries in a scoped directory as a privilege-escalation lead.
- 03
Finding world-writable files an unprivileged user could replace.
- 04
Narrowing to recently modified files after a suspected change window.
QUICK START
On a Linux host already in scope, when you need files that match a name, type, or mode instead of browsing directory by directory.
- Confirm the host and the starting directory are in scope.
- Search a specific tree for names you already care about, sending errors aside.
- Review the hit list before opening files; skip caches, proc, and huge logs.
- Copy only what the rules of engagement allow into the loot folder.
find /var/www -type f -name '*.env' 2>/dev/nullBEFORE YOU RUN IT
What to check before running it
A find of `/` hammers disk and shows up in audit logs and EDR file-access telemetry — keep the start path tight.
Opening every hit can scoop live credentials and personal data; handle them under the NDA and do not copy them off-box without authorization.
Some filesystems (NFS, FUSE, container mounts) make a naive walk hang or cross into out-of-scope trees — prune those paths.