E-LS
ls
List a directory with hidden files, modes, and timestamps — first look at a foothold.
OVERVIEW
ls from GNU coreutils (gnu.org/software/coreutils) prints a directory listing. The pentest-useful form is almost always `ls -la`: every file including dotfiles, with mode, owner, group, size, and mtime. That is how you notice a world-writable script, an unexpected `.ssh`, or a backup sitting next to the app.
Color, aliases, and `ls -l` without `-a` hide the interesting names. Call `/bin/ls -la` when the shell might be aliased, and add `-h` or `--time-style=long-iso` when you need sizes and timestamps you can paste into notes. Recurse only with a tight path; for a whole tree, `find` is the better tool.
USE CASES
Practical use cases
- 01
Inspecting a web root or home directory for dotfiles and leftover backups.
- 02
Checking owner and mode on a script or config before treating it as writable.
- 03
Comparing timestamps on a small set of files after a suspected change.
- 04
Confirming that a path from find or a report actually exists on this host.
QUICK START
When you land in a directory on a Linux host and need to see what is actually there — including dotfiles, modes, and owners — before searching the rest of the tree.
- Confirm the directory is on a host in scope.
- List with -la so hidden names and modes show up.
- Note any unexpected owners, world-writable bits, or backup-looking names.
- Follow up on those paths with find or by reading the file — do not recurse ls across the whole disk.
ls -la /var/www /home /optBEFORE YOU RUN IT
What to check before running it
Shell aliases (`ls="ls --color"` or `ls="ls -F"`) can hide names; use `/bin/ls` when the listing looks too clean.
Directory listing is still file-access telemetry on a monitored host — keep it to the trees you need.
ls does not follow a hunt across the disk; a recursive `ls -lR /` is slow, noisy, and worse than a targeted find.