Match Files to Packages in Debian-Based Operating Systems

dpkg-query is the Debian package database tool. It answers three questions that come up constantly during reconnaissance and forensics:

# List all installed packages
dpkg-query -l
 
# List every file installed by a specific package
dpkg-query -L $PACKAGE_NAME
 
# Find which package owns a specific file on disk
dpkg-query -S $FULL_PATH_TO_FILE

Why this matters

• Recon: On a foothold, dpkg-query -l reveals installed software (databases, web servers, dev tools) without making network noise.
• Forensics: Finding an unexpected binary in /tmp or /dev/shm? dpkg-query -S /tmp/suspicious tells you whether it came from a package or was dropped.
• Package integrity: Compare dpkg-query -L output against debsums or rpm -Va equivalents to spot tampered files.

Related

• bash-wildcard-abuse — another Debian/Linux post-exploitation concern
• suid-shell-executable — SUID binaries are often identified via package queries

Sources

• dpkg-query(1) — Linux manual page
• dpkg(1) — Linux manual page