Bash: Viewing Files
Reading file contents is crucial for reconnaissance, analyzing logs, reviewing configurations, and examining data. Linux provides powerful tools for viewing files in different ways. This lesson covers everything from quick peeks to advanced filtering and searching.
What You'll Learn
- Viewing entire files (cat, less, more)
- Viewing parts of files (head, tail)
- Real-time file monitoring (tail -f)
- Searching within files (grep)
- Comparing files (diff)
- Viewing binary and hex dumps
- Practical pentesting scenarios
Basic File Viewing
1. cat - Concatenate and Display
View entire file:
cat filename.txt
View multiple files:
cat file1.txt file2.txt
Number lines:
cat -n filename.txt
Show non-printing characters:
cat -A filename.txt
# Shows tabs as ^I, line endings as $
Combine files:
cat file1.txt file2.txt > combined.txt
Use cases:
# Quick view of short files
cat /etc/hosts
cat targets.txt
# View credentials
cat /etc/passwd
cat /etc/shadow # (requires root)
# Read SSH keys
cat ~/.ssh/id_rsa.pub
2. less - View Files with Navigation
Basic usage:
less filename.txt
Navigation:
Space # Next page
b # Previous page
Enter # Next line
k # Up one line
j # Down one line
g # Go to beginning
G # Go to end
/pattern # Search forward
?pattern # Search backward
n # Next search result
N # Previous search result
q # Quit
h # Help
Advantages over cat:
- Doesn't load entire file (fast for large files)
- Allows scrolling and searching
- Doesn't clutter terminal
Examples:
# View large log file
less /var/log/syslog
# View with line numbers
less -N filename.txt
# Search within file
less filename.txt
/searchterm
3. more - Simple Pager
Basic usage:
more filename.txt
Navigation:
Space # Next page
Enter # Next line
q # Quit
Note: less is more powerful than more. Use less most of the time!
Viewing Specific Parts
1. head - View Beginning of File
First 10 lines (default):
head filename.txt
Specific number of lines:
head -n 20 filename.txt
# Or shorthand:
head -20 filename.txt
Multiple files:
head file1.txt file2.txt
Use cases:
# Check file format
head data.csv
# Preview log file
head /var/log/apache2/access.log
# Check first IPs in list
head -5 targets.txt
2. tail - View End of File
Last 10 lines (default):
tail filename.txt
Specific number of lines:
tail -n 20 filename.txt
# Or:
tail -20 filename.txt
Skip first N lines:
tail -n +11 filename.txt
# Shows from line 11 onwards
Use cases:
# Check recent log entries
tail /var/log/syslog
# View end of scan results
tail nmap_scan.txt
# Last 5 findings
tail -5 vulnerabilities.txt
3. tail -f - Follow File in Real-Time
Monitor file as it grows:
tail -f filename.txt
Continuously displays new lines as they're added.
Exit: Press Ctrl+C
Practical examples:
# Monitor system log live
tail -f /var/log/syslog
# Watch scan progress
nmap target.com > scan.log &
tail -f scan.log
# Monitor web server access
tail -f /var/log/apache2/access.log
# Follow multiple files
tail -f /var/log/syslog /var/log/auth.log
Searching Within Files
grep - Search for Patterns
Basic search:
grep "pattern" filename.txt
Case-insensitive:
grep -i "pattern" filename.txt
Show line numbers:
grep -n "pattern" filename.txt
Recursive search (all files in directory):
grep -r "pattern" /path/to/directory
Invert match (lines NOT containing pattern):
grep -v "pattern" filename.txt
Count matches:
grep -c "pattern" filename.txt
Show only matched part:
grep -o "pattern" filename.txt
Multiple patterns:
grep -e "pattern1" -e "pattern2" filename.txt
# Or:
grep -E "pattern1|pattern2" filename.txt
Context lines:
# Show 3 lines before match
grep -B 3 "pattern" filename.txt
# Show 3 lines after match
grep -A 3 "pattern" filename.txt
# Show 3 lines before AND after
grep -C 3 "pattern" filename.txt
Practical examples:
# Find IPs in file
grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' file.txt
# Find emails
grep -oE '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}' file.txt
# Find errors in log
grep -i "error" /var/log/syslog
# Find failed logins
grep "Failed password" /var/log/auth.log
# Find specific user
grep "username" /etc/passwd
# Find open ports in nmap scan
grep "open" nmap_scan.txt
# Exclude comments
grep -v "^#" /etc/ssh/sshd_config
# Find credentials in config files
grep -ri "password" /etc/
Comparing Files
diff - Show Differences
Compare two files:
diff file1.txt file2.txt
Side-by-side comparison:
diff -y file1.txt file2.txt
Unified format (like git diff):
diff -u file1.txt file2.txt
Ignore whitespace:
diff -w file1.txt file2.txt
Practical examples:
# Compare config before/after
diff original_config.conf modified_config.conf
# Compare scan results
diff scan_before.txt scan_after.txt
# Find new entries
diff old_users.txt new_users.txt
# Check what changed
diff /etc/passwd /tmp/passwd.backup
Viewing Binary Files
hexdump - Hex Viewer
View file in hex:
hexdump -C filename
Example:
$ hexdump -C /bin/ls | head
00000000 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 |.ELF............|
00000010 03 00 3e 00 01 00 00 00 50 64 00 00 00 00 00 00 |..>.....Pd......|
xxd - Hex Dump
Hex dump:
xxd filename
Reverse hex dump (hex → binary):
xxd -r hexdump.txt binary_file
Use cases:
# Examine executable
xxd /bin/bash | less
# Check file signature
xxd -l 16 file.pdf
# PDF starts with: 25 50 44 46 (%PDF)
# View shellcode
xxd shellcode.bin
strings - Extract Readable Text
Find printable strings in binary:
strings filename
Minimum length:
strings -n 10 filename
# Only strings 10+ characters
Practical examples:
# Find hardcoded strings in binary
strings /usr/bin/program
# Extract URLs from binary
strings malware.exe | grep http
# Find passwords in memory dump
strings memory.dmp | grep -i password
# Analyze unknown file
strings unknown_file | less
Advanced Viewing
wc - Word Count
Count lines, words, and bytes:
wc filename.txt
Output:
100 500 3000 filename.txt
^ ^ ^
lines words bytes
Count lines only:
wc -l filename.txt
Count words only:
wc -w filename.txt
Count bytes:
wc -c filename.txt
Practical examples:
# Count targets
wc -l targets.txt
# Count findings
wc -l vulnerabilities.txt
# Count open ports
grep "open" nmap_scan.txt | wc -l
# Count unique IPs
cat access.log | cut -d' ' -f1 | sort -u | wc -l
cut - Extract Columns
Extract field:
cut -d'delimiter' -f field_number filename
Examples:
# Extract usernames from /etc/passwd
cut -d':' -f1 /etc/passwd
# Extract IPs from CSV
cut -d',' -f2 data.csv
# Extract first 10 characters
cut -c1-10 filename.txt
# Multiple fields
cut -d':' -f1,3,6 /etc/passwd
sort - Sort Lines
Alphabetical sort:
sort filename.txt
Reverse order:
sort -r filename.txt
Numeric sort:
sort -n numbers.txt
Unique lines only:
sort -u filename.txt
uniq - Remove Duplicates
Remove adjacent duplicates:
uniq filename.txt
Count occurrences:
uniq -c filename.txt
Show only duplicates:
uniq -d filename.txt
Note: Usually combined with sort:
sort filename.txt | uniq
Practical Pentesting Scenarios
Scenario 1: Analyze Web Access Logs
# View recent entries
tail -100 /var/log/apache2/access.log
# Find 404 errors
grep " 404 " access.log
# Count unique IPs
cut -d' ' -f1 access.log | sort -u | wc -l
# Top 10 IPs
cut -d' ' -f1 access.log | sort | uniq -c | sort -rn | head -10
# Find SQL injection attempts
grep -i "select\|union\|drop" access.log
# Find directory traversal
grep "\.\." access.log
Scenario 2: Parse Nmap Results
# Find open ports
grep "open" nmap_scan.txt
# Extract service versions
grep "open" nmap_scan.txt | grep -oP '\d+/tcp.*'
# Count services
grep "open" nmap_scan.txt | wc -l
# Find specific service
grep "ssh" nmap_scan.txt
Scenario 3: Analyze /etc/passwd
# View file
cat /etc/passwd
# Extract usernames
cut -d':' -f1 /etc/passwd
# Find users with UID 0 (root privileges)
awk -F: '$3 == 0 {print $1}' /etc/passwd
# Find users with login shells
grep -v "nologin\|false" /etc/passwd
# Count users
wc -l /etc/passwd
Scenario 4: Monitor Live Activity
# Watch auth log for login attempts
tail -f /var/log/auth.log
# Monitor system log
tail -f /var/log/syslog
# Watch for failed SSH logins
tail -f /var/log/auth.log | grep "Failed password"
# Monitor multiple logs
tail -f /var/log/{syslog,auth.log,kern.log}
Quick Reference
Full File:
cat file.txt # Display entire file
less file.txt # Scrollable viewer
more file.txt # Simple pager
Parts:
head file.txt # First 10 lines
head -20 file.txt # First 20 lines
tail file.txt # Last 10 lines
tail -20 file.txt # Last 20 lines
tail -f file.txt # Follow (real-time)
Search:
grep "pattern" file # Search
grep -i "pattern" file # Case-insensitive
grep -r "pattern" /path # Recursive
grep -v "pattern" file # Invert match
grep -n "pattern" file # Show line numbers
grep -A 3 "pattern" file # 3 lines after
grep -B 3 "pattern" file # 3 lines before
Binary:
hexdump -C file # Hex dump
xxd file # Hex dump
strings file # Printable strings
Analysis:
wc -l file # Count lines
cut -d':' -f1 file # Extract column
sort file # Sort lines
uniq file # Remove duplicates
diff file1 file2 # Compare files
Resources
Man Pages:
man cat
man less
man grep
man tail
man diff
Practice:
- OverTheWire: Bandit: Levels 0-15
- Log analysis on your own Linux system
Next Steps
- Master grep - most useful command for pentesting
- Practice tail -f for live monitoring
- Learn regex for advanced grep patterns
- Combine commands with pipes
- Analyze real logs from your system
File viewing seems simple, but mastering these tools will save you hours during engagements!
"grep: Because Ctrl+F is for amateurs."