Copy filecp -a archivo.zip archivocopia.zip |
Create a 404.html filetouch /home/usuario/public_html/404.html |
Compress directoryzip -r archivo.zip /home/usuario/public_html/directorio |
Extract fileunzip archivo.zip |
View contents of a zip fileunzip -v archivo.zip |
Compress files excluding certain extensionszip -r /home/user/public_html/backup_php_ah.zip /home/user/public_html/uploads/ -x */\.* *.git* \.* *.JPG *.jpg *.PNG *.PDF *.pdf *.msg *.jpeg *.zip *.rar *.xlsx *.PDF *.png *.mp4 *.html *.docx *.pptx |
List files and foldersls |
List files and folders with detailed informationls -al |
List files, folders, and subdirectoriesls -aR |
List files and information including all subdirectories with paginationls -aR | more |
List files and subdirectory information and save it to a filels -alR > resultado.txt |
List all files ending in .htmlls *.html |
Count the number of folders in a directory (excludes files)echo */ | wc |
Show folder sizedu -h | grep \/.*\\/ -v |
Search in home for a file named whatever with a size greater than 5MB.find /home/ -name lo_que_sea -size +5M |
Show directory space usagedu -sh |
Show space used by each file sorted by sizedu -hs * | sort -h |
It is important to be careful with trailing slashes on folders. If NOT placed, the last folder will be recreated inside the command destination.
Synchronize information within the same serverrsync -avhzo /home/usuario/carpeta_origen/ /home/usuario/carpeta_destino/ |
Synchronize information from an external server. This command is executed from the destination server. This instruction uses port 22, so the source server must have SSH enabled.rsync -avhzo root@servidor.origen.com:/home/usuario/carpeta_origen/ /home/usuario/carpeta_destino/ |
Synchronize information from an external server. This command is executed from the destination server. This instruction uses port 1157. Replace it with the port that the source server has configured for SSH connections.rsync -avhzo -e "ssh -p1157" root@servidor.origen.com:/home/usuario/carpeta_origen/ /home/usuario/carpeta_destino/ |
Check if Apache has reached the worker limit and needs to increase its valuegrep -i maxclient /usr/local/apache/logs/error_log |
Count the number of processes running on port 80netstat -an | grep :80 | wc -l |
Count the number of accesses to port 80 by a single IPnetstat -an | grep :80 | egrep '^tcp' | grep -v LISTEN | awk '{print $5}' | egrep '([0-9]{1,3}\.){3}[0-9]{1,3}' | sed 's/^\(.*:\)\?\(\([0-9]\{1,3\}\.\)\{3\}[0-9]\{1,3\}\).*$/\2/' | sort | uniq -c | sort -nr | sed 's/::ffff://' | head -20 |
If the attack is from multiple IPs, we can trace the entire /24 subnetnetstat -ntu | awk '{print $5}' | cut -d: -f1 -s | cut -f1,2,3 -d'.' | sed 's/$/.0/' | sort | uniq -c | sort -nk1 -r |
Or, the broader subnet: /16netstat -ntu | awk '{print $5}' | cut -d: -f1 -s | cut -f1,2 -d'.' | sed 's/$/.0.0/' | sort | uniq -c | sort -nk1 -r |
Check the TOP processes using processing capacity (execute line by line after "#").# resize;clear;echo;date;echo "Top 10 Processes by CPU %";echo ""; ps -eo user,%cpu,%mem,rsz,args,pid,lstart|sort -rnk2|\ |
This command creates a file called proc-list that shows exactly what a specific process is doing (replace PID-Number).ps awux | grep lsofls -l /proc/PID-Number/* > /root/proc-list |
Check visitors in Apache status who are attacking WordPress login. Can be replaced with any other attacked script./usr/local/apache/bin/apachectl fullstatus | grep 'wp-login\|xmlrp' |
LOG analysiscat /usr/local/apache/logs/access_log | awk '{print $1}' | sort | uniq -c | sort -nAnalyzes the Apache access log and shows the number of times an IP has connected to Apache. |
Search all activity of an IP in the Apache log and error log.grep -i [IP] /usr/local/apache/logs/access_loggrep -i [IP] /usr/local/apache/logs/error_log |
Analysis of directories from which email is being sentgrep cwd /var/log/exim_mainlog | grep -v /var/spool | awk -F"cwd=" '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -n |
Number of emails in the Queue Manager/usr/sbin/exim -bpc |
Once a suspicious directory is detected, you can identify the suspicious script and search for the accesses it has had to block the resulting IPsgrep "mailer.php" /home/userna5/access-logs/example.com | awk '{print $1}' | sort -n | uniq -c | sort -n |
Analyze possible attack on EXIM/usr/sbin/exigrep "unrecognized command" /var/log/exim_mainlog |
Analyze if there are blocks in Hotmail/usr/sbin/exigrep "Unfortunately, some messages from" /var/log/exim_mainlog |
Analyze if there are blocks in Yahoo/usr/sbin/exigrep "temporarily deferred due to user complaints" /var/log/exim_mainlog |
| Delete messages from the Exim queue Single sender: exiqgrep -if user@domain | xargs exim -MrmSingle recipient:exiqgrep -ir user@domain | xargs exim -MrmClear all: exim -bp | grep < | awk '{print $3}' | xargs exim -Mrm |
Show CPU informationcat /proc/cpuinfo |
Count the physical processors of a servercat /proc/cpuinfo | grep proc | tail -n 1 |
Show disk partitions and mountslsblk |