_ ReconLab
Commands  / Core Linux  / find

find

Search the filesystem by criteria.

KaliParrotLinuxpassive

pkg: findutils

find locates files by name, type, time, size or permission and can act on results — key for privesc hunting (e.g. SUID files).

Syntax

find {path} [tests] [-exec ...]

Example

find / -perm -4000 -type f 2>/dev/null

Lists SUID binaries system-wide — a classic Linux privilege-escalation check.

Options & flags

What each switch does. Toggle them in the builder below to assemble a command.

-name <*.conf>Match by filename (quote wildcards).
-type <f>f=file, d=dir, l=symlink.
-perm <-4000>Match permission bits, e.g. -4000 (SUID).
-mtime <-1>Modified N days ago.
-size <+10M>File size, e.g. +10M.
-exec <cat {} \;>Run a command on each match ({} = file).
-user <root>Owned by a user.

Command builder

Tick options (and fill any values) to build a ready-to-copy command.

find

Usage examples

find / -perm -4000 -type f 2>/dev/null

Find SUID binaries (privesc hunting).

find . -name "*.bak" -mtime -7

Recently-changed backup files.

Advantages
  • Extremely expressive criteria
  • Can execute actions on matches
  • Core privesc/enum tool
Disadvantages
  • Syntax trips up beginners
  • Full scans are slow/noisy
  • Permission errors clutter output
Tags
#filesystem#privesc#enumeration

Official docs: GNU find ↗

Related commands

grep

Search text with regular expressions.

Frequently asked questions

What is find used for?
find locates files by name, type, time, size or permission and can act on results — key for privesc hunting (e.g. SUID files).
What is an example find command?
A common example is: find / -perm -4000 -type f 2>/dev/null — Lists SUID binaries system-wide — a classic Linux privilege-escalation check.
Is find part of Kali Linux?
Yes. find ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install findutils.
What category of security tool is find?
find is a Core Linux tool with a passive-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →