$ Linux One Liners
Back to commands

Cybersecurity Triage

Read-only, sensitive output

Find World-Readable Secret-Looking Files

You need to find files with sensitive names that are readable by everyone.

Command

find /srv/www/example -type f -perm -0004 \( -iname '*secret*' -o -iname '*.env' -o -iname '*token*' -o -iname '*key*' \) -printf '%M %u:%g %p\n' 2>/dev/null | sort

Before you run this

System impact: Read-only. Output may expose users, paths, tokens, keys, IPs, process arguments, or log details.

When not to use it: Do not treat filename matching as a complete secrets scan; it is a fast first pass.

Expected output

World-readable files whose names suggest secrets, keys, tokens, or environment config.

System impact

Read-only, sensitive output. Nothing changes. The command lists suspicious readable files for review.

Recovery / rollback: no state is changed.

When to use it

Use during production handoff, incident triage, or before publishing an artifact.

When not to use it

Do not treat filename matching as a complete secrets scan; it is a fast first pass.

next steps

Related commands

Cybersecurity Triage Can be slow

Find Config Files with Execute Bits

Config files do not usually need to be executable.

find /srv/www/example -type f -perm /111 \( -path '*/config/*' -o -name '*.env' -o -name '*.conf' \) -printf '%M %u:%g %p\n' 2>/dev/null | sort
Cybersecurity Triage Can be slow

Find Upload Files Writable Outside the Owner

Uploads are supposed to be writable at the edge, not writable forever by everyone.

find /srv/www/example/shared/uploads -type f -perm /0022 -printf '%M %u:%g %p\n' 2>/dev/null | sort
Cybersecurity Triage Can be slow

Find Writable Directories Missing the Sticky Bit

A writable log directory is not the same thing as a safe shared directory.

find /srv/www/example -type d -perm -0002 ! -perm -1000 -printf '%m %u:%g %p\n' 2>/dev/null | sort
Hosting Operations Can be slow

Group Writable Files by Owning Group

Group-writable files are not automatically wrong, but the owning group decides the risk.

find /srv/www/example -type f -perm -0020 -printf '%g %M %p\n' 2>/dev/null | sort
Study mapping

Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.

  • LPIC-1 style command-line practice
  • LFCS style performance-task practice
  • Linux+ style troubleshooting review

Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.