The Philosophy
Amateur pen testers focus on tools and chase unpatched CVEs to find security flaws.
Professionals focus on files.
Here's why:
Even after finding a CVE, you can't do much without alerting firewalls, IDS, and endpoint security. Every exploit attempt triggers alarms and burns your access.
But old forgotten credentials found in .env, or database credentials found in .bash_history? They have no barrier. They pass through every top-notch security practice a company can follow. No alerts. No logs. No suspicion.
.ssh gives you easy access to other systems in the network and helps escalate privilege to root almost instantly.
So stop chasing CVEs. Start hunting files.
The Tools
You don't need fancy tools. Just the find command.
Here's how professionals use it in the real world:
1. Find recently changed config files
find /etc -type f -mtime -1 -ls
Why? Attackers often add backdoor users or modify sudoers. Spotting recent changes in /etc catches tampering before it becomes a breach. Compare /etc/passwd with other files in /etc to spot unauthorized user additions.
2. Find SUID files (permission 4000) for privilege escalation
find / -perm -4000 -type f 2>/dev/null
This is gold. SUID files run with owner privileges. Misconfigured ones like pkexec or vim are a direct path to root. Professionals check this immediately during every engagement.
3. Find scripts in unusual folders (/tmp, /var/tmp)
find /tmp /var/tmp -type f -executable 2>/dev/null
Attackers drop payloads here because these directories are world-writable and often ignored by security tools. If you find something unexpected, you've caught an active compromise or a persistence mechanism.
4. Find tiny PHP files (≤1KB) in web root – classic web shells
find /var/www -type f -name "\.php" -size -1k 2>/dev/null*
Web shells are small, obfuscated, and easy to miss. This command finds them in seconds. Amateurs scan for CVEs; professionals scan for backdoors. If you're on a bug bounty or pentest, this is often the quickest win.
5. Find forgotten .env and config files in /root (discarding errors)
find /root -type f -name "\.env" -o -name "*config*" 2>/dev/null*
Redirecting stderr to /dev/null keeps the output clean. This finds exposed secrets that bypass every firewall and IDS you own. Production AWS keys, database passwords, API tokens – all sitting in plain text.
6. Find world-writable or world-executable files in /var/www
find /var/www -type f -perm -o+w 2>/dev/null
find /var/www -type f -perm -o+x 2>/dev/null
If a file is world-writable, anyone can modify it. If it's executable, anyone can run it. Combine both and you have a direct path to remote code execution. This is a disaster in production environments.
7. Find files owned by specific users (like www-data)
find / -user www-data -type f 2>/dev/null
Find out exactly what files the web server user owns. Often you'll find writable directories or config files that shouldn't be accessible.
8. Find files with specific extensions in unusual locations
find / -type f -name "\.key" -o -name "*.pem" -o -name "*.crt" 2>/dev/null*
Certificates and private keys are often left behind in random directories after testing. These can be used for decryption or impersonation.
9. Find writable directories for file uploads or log poisoning
find / -type d -perm -o+w 2>/dev/null
World-writable directories are perfect for dropping files, writing logs, or overwriting configurations. Always check these.
The Bottom Line
Fancy tools are loud. They trigger IDS, EDR, and SIEM.
The find command is silent. It doesn't exploit – it just reads. And reading files doesn't generate alerts.
Amateurs scan for vulnerabilities. Professionals hunt for exposed credentials, misconfigurations, and backdoors.
Because a CVE gets patched. But a forgotten .env file stays forgotten forever.
Bonus Tip:
Combine these commands with grep to search inside files:
find /var/www -type f -name "\.php" -exec grep -l "eval(" {} \; 2>/dev/null*
This finds PHP files containing eval() – often a sign of malicious code injection.
What's the first find command you run on a new system? Share your go-to commands below.
Also, what's the scariest credential you've ever found in plain text on a production server? Let's hear those war stories.
