Commands by faceinthecrowd (1)

  • I have found that base64 encoded webshells and the like contain lots of data but hardly any newlines due to the formatting of their payloads. Checking the "width" will not catch everything, but then again, this is a fuzzy problem that relies on broad generalizations and heuristics that are never going to be perfect. What I have done is set an arbitrary threshold (200 for example) and compare the values that are produced by this script, only displaying those above the threshold. One webshell I tested this on scored 5000+ so I know it works for at least one piece of malware.

    for ii in $(find /path/to/docroot -type f -name \*.php); do echo $ii; wc -lc $ii | awk '{ nr=$2/($1 + 1); printf("%d\n",nr); }'; done
    faceinthecrowd · 2013-04-05 19:06:17 10

What's this? is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands

Check These Out

Get a diff of two json arrays
jq is amazing for manipulating json on the commandline, but the developers have some weird ideas about how to handle shell redirections. This command works around them. Further reading:

SMS reminder
Send an e-mail to SMS reminder in 15 minutes from now, to call my wife. See list of carriers bellow Carrier Email to SMS Gateway Alltel [10-digit phone number] AT&T (formerly Cingular) [10-digit phone number] [10-digit phone number] (MMS) [10-digit phone number] Boost Mobile [10-digit phone number] Nextel (now Sprint Nextel) [10-digit telephone number] Sprint PCS (now Sprint Nextel) [10-digit phone number] [10-digit phone number] (MMS) T-Mobile [10-digit phone number] US Cellular [10-digit phone number] (SMS) [10-digit phone number] (MMS) Verizon [10-digit phone number] [10-digit phone number] (MMS) Virgin Mobile USA [10-digit phone number]

show git logging
shows some logging for the git repo.

Which processes are listening on a specific port (e.g. port 80)
swap out "80" for your port of interest. Can use port number or named ports e.g. "http"

Listing directory content of a directory with a lot of entries
Ever wanted to get the directory content with 'ls' or 'find' and had to wait minutes until something was printed? Perl to the rescue. The one-liner above(redirected to a file) took less than five seconds to run in a directory with more man 2 million files. One can adapt it to e.g. delete files that match a certain pattern.

Rename files in batch

Find duplicate UID in /etc/passwd
You can use only awk

Project your desktop using xrandr
HDMI-1 is the interface in the example, which can be obtained just by typing xrandr and surfing through the output. There are a hell lot of configurations that can be done but I prefer auto because it works in most cases. $ Lifesaver

Vectorize xkcd strips
Uses ImageMagick and potrace to vectorize the input image, with parameters optimized for xkcd-like pictures.

Find the processes that are on the runqueue. Processes with a status of
Want to know why your load average is so high? Run this command to see what processes are on the run queue. Runnable processes have a status of "R", and commands waiting on I/O have a status of "D". On some older versions of Linux may require -emo instead of -eo. On Solaris: ps -aefL -o s -o user -o comm | egrep "^O|^R|COMMAND"

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.


Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for: