Commands by faceinthecrowd (1)

  • I have found that base64 encoded webshells and the like contain lots of data but hardly any newlines due to the formatting of their payloads. Checking the "width" will not catch everything, but then again, this is a fuzzy problem that relies on broad generalizations and heuristics that are never going to be perfect. What I have done is set an arbitrary threshold (200 for example) and compare the values that are produced by this script, only displaying those above the threshold. One webshell I tested this on scored 5000+ so I know it works for at least one piece of malware.


    0
    for ii in $(find /path/to/docroot -type f -name \*.php); do echo $ii; wc -lc $ii | awk '{ nr=$2/($1 + 1); printf("%d\n",nr); }'; done
    faceinthecrowd · 2013-04-05 19:06:17 4

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands


Check These Out

list files recursively by size

Remove invalid key from the known_hosts file for the IP address of a host
Quick shortcut if you know the hostname and want to save yourself one step for looking up the IP address separately.

Prepend a text to a file.
Prepend text to a file. It doen't need temporary files, ed or sed.

Find the package that installed a command

Word-based diff on reformatted text files
It can be hard to spot differences in reformatted files, because of all the diff noise created by word wrapped lines. This command removes all the noise and performs a word-by-word diff. To ignore empty lines, add -B to the diff command. Also, if this is something you do often, you might want to check out the wdiff(1) program.

Install pip with Proxy
Installs pip packages defining a proxy

Create subversion undo point
Allows you to save progress without committing. To revert to an undo point, svn revert then apply the undo point with patch. $ svn revert -R . && patch -p0 < .undo/2009-03-27_08:08:11rev57 Similar: http://www.commandlinefu.com/commands/view/373/archive-all-files-containing-local-changes-svn

pretend to be busy in office to enjoy a cup of coffee
Not as taxing on the CPU.

Show a config file without comments

Automatic ssh Session Logger
A wrapper around ssh to automatically provide logging and session handling. This function runs ssh, which runs screen, which runs script. . The logs and the screen session are stored on the server. This means you can leave a session running and re-attach to it later, or from another machine. . . Requirements: * Log sessions on a remote server * Transparent - nothing extra to type * No installation - nothing to copy to the server beforehand . Features: * Function wrapper delegating to ssh - so nothing to remember - uses .ssh/config as expected - passes your command line option to ssh * Self-contained: no scripts to install on the server * Uses screen(1), so is: - detachable - re-attachable - shareable * Records session using script(1) * Configurable log file location, which may contain variables or whitespace L="$HOME" # local variable L="\$HOME" # server variable L="some space" . Limitations: * Log dir/file may not contain '~' (which would require eval on the server) . . The sessions are named by the local user connecting to the server. Therefore if you detach and re-run the same command you will reconnect to your original session. If you want to connect/share another's session simply run: $ USER=bob ssh root@server . The command above is stripped down to an absolute minimum. A fully expanded and annotated version is available as a Gist (git pastebin): https://gist.github.com/flatcap/3c42326abeb1197ee714 . If you want to add timing info to script, change the command to: $ ssh(){ L="\$HOME/logs/$(date +%F_%H:%M)-$USER";/usr/bin/ssh -t "$@" "mkdir -p \"${L%/*}\";screen -xRRS $USER script --timing=\"$L-timing\" -f \"$L\"";}


Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for: