linux 查找
locate 命令 根据关键字在整个Linux系统中查找 定位
1.基于自己的数据库 对文件进行查找；会把匹配的文件全部给出
┌──(root㉿kali)-[~]
└─# locate -h
Usage: plocate [OPTION]... PATTERN...
-b, --basename search only the file name portion of path names
-c, --count print number of matches instead of the matches
-d, --database DBPATH search for files in DBPATH
(default is /var/lib/plocate/plocate.db)
-i, --ignore-case search case-insensitively
-l, --limit LIMIT stop after LIMIT matches
-0, --null delimit matches by NUL instead of newline
-N, --literal do not quote filenames, even if printing to a tty
-r, --regexp interpret patterns as basic regexps (slow)
--regex interpret patterns as extended regexps (slow)
-w, --wholename search the entire path name (default; see -b)
--help print this help
--version print version information
──(root㉿kali)-[~]
└─# locate aircrack-ng
/usr/bin/aircrack-ng
/usr/include/aircrack-ng
/usr/include/aircrack-ng/adt
/usr/include/aircrack-ng/aircrack-ng.h
/usr/include/aircrack-ng/ce-wep
/usr/include/aircrack-ng/ce-wpa
/usr/include/aircrack-ng/compat.h
/usr/include/aircrack-ng/cowpatty
/usr/include/aircrack-ng/cpu
/usr/include/aircrack-ng/crypto
/usr/include/aircrack-ng/defs.h
/usr/include/aircrack-ng/osdep
/usr/include/aircrack-ng/ptw
/usr/include/aircrack-ng/support
/usr/include/aircrack-ng/third-party
/usr/include/aircrack-ng/tui
/usr/include/aircrack-ng/utf8
/usr/include/aircrack-ng/version.h
/usr/include/aircrack-ng/adt/avl_tree.h
/usr/include/aircrack-ng/adt/circular_buffer.h
/usr/include/aircrack-ng/adt/circular_queue.h
/usr/include/aircrack-ng/ce-wep/uniqueiv.h
/usr/include/aircrack-ng/ce-wpa/aligned.h
/usr/include/aircrack-ng/ce-wpa/arch.h
/usr/include/aircrack-ng/ce-wpa/crypto_engine.h
/usr/include/aircrack-ng/ce-wpa/jcommon.h
/usr/include/aircrack-ng/ce-wpa/johnswap.h
/usr/include/aircrack-ng/ce-wpa/memory.h
/usr/include/aircrack-ng/ce-wpa/misc.h
/usr/include/aircrack-ng/ce-wpa/pseudo_intrinsics.h
/usr/include/aircrack-ng/ce-wpa/simd-intrinsics-load-flags.h
/usr/include/aircrack-ng/ce-wpa/simd-intrinsics.h
/usr/include/aircrack-ng/ce-wpa/wpapsk.h
/usr/include/aircrack-ng/cowpatty/cowpatty.h
/usr/include/aircrack-ng/cpu/cpuset.h
/usr/include/aircrack-ng/cpu/simd_cpuid.h
/usr/include/aircrack-ng/cpu/trampoline.h
/usr/include/aircrack-ng/crypto/crctable.h
/usr/include/aircrack-ng/crypto/crypto.h
/usr/include/aircrack-ng/crypto/gcrypt-openssl-wrapper.h
/usr/include/aircrack-ng/crypto/sha1-git.h
/usr/include/aircrack-ng/crypto/sha1-sse2.h
/usr/include/aircrack-ng/osdep/byteorder.h
/usr/include/aircrack-ng/osdep/channel.h
/usr/include/aircrack-ng/osdep/common.h
/usr/include/aircrack-ng/osdep/network.h
/usr/include/aircrack-ng/osdep/osdep.h
/usr/include/aircrack-ng/osdep/packed.h
/usr/include/aircrack-ng/ptw/aircrack-ptw-lib.h
/usr/include/aircrack-ng/support/common.h
/usr/include/aircrack-ng/support/communications.h
/usr/include/aircrack-ng/support/crypto_engine_loader.h
/usr/include/aircrack-ng/support/fragments.h
/usr/include/aircrack-ng/support/mcs_index_rates.h
/usr/include/aircrack-ng/support/pcap_local.h
/usr/include/aircrack-ng/support/station.h
/usr/include/aircrack-ng/third-party/eapol.h
/usr/include/aircrack-ng/third-party/ethernet.h
/usr/include/aircrack-ng/third-party/hashcat.h
/usr/include/aircrack-ng/third-party/ieee80211.h
/usr/include/aircrack-ng/third-party/if_arp.h
/usr/include/aircrack-ng/third-party/if_llc.h
/usr/include/aircrack-ng/tui/console.h
/usr/include/aircrack-ng/utf8/verifyssid.h
/usr/share/applications/kali-aircrack-ng.desktop
/usr/share/doc/aircrack-ng
/usr/share/doc/aircrack-ng/README.Debian
/usr/share/doc/aircrack-ng/README.gz
/usr/share/doc/aircrack-ng/changelog.Debian.gz
/usr/share/doc/aircrack-ng/changelog.gz
/usr/share/doc/aircrack-ng/copyright
/usr/share/icons/Flat-Remix-Blue-Dark/apps/scalable/aircrack-ng.svg
/usr/share/icons/Flat-Remix-Blue-Dark/apps/scalable/kali-aircrack-ng.svg
/usr/share/icons/hicolor/16x16/apps/kali-aircrack-ng.png
/usr/share/icons/hicolor/22x22/apps/kali-aircrack-ng.png
/usr/share/icons/hicolor/24x24/apps/kali-aircrack-ng.png
/usr/share/icons/hicolor/256x256/apps/kali-aircrack-ng.png
/usr/share/icons/hicolor/32x32/apps/kali-aircrack-ng.png
/usr/share/icons/hicolor/48x48/apps/kali-aircrack-ng.png
/usr/share/icons/hicolor/scalable/apps/kali-aircrack-ng.svg
/usr/share/kali-menu/applications/kali-aircrack-ng.desktop
/usr/share/man/man1/aircrack-ng.1.gz
/var/lib/dpkg/info/aircrack-ng.list
/var/lib/dpkg/info/aircrack-ng.md5sums
/var/lib/dpkg/info/aircrack-ng.shlibs
/var/lib/dpkg/info/aircrack-ng.triggers
──(root㉿kali)-[~/work/exam]
└─# touch kalil
┌──(root㉿kali)-[~/work/exam]
└─# locate kalil
┌──(root㉿kali)-[~/work/exam]
└─# updatedb
┌──(root㉿kali)-[~/work/exam]
└─# locate kalil
/root/work/exam/kalil
┌──(root㉿kali)-[~/work/exam]
└─# ls -ld kalil
-rw-r--r-- 1 root root 0 8月17日 16:17 kalil
whereis 查找二进制可执行文件
┌──(root㉿kali)-[~/work/exam]
└─# whereis passwd
passwd: /usr/bin/passwd /etc/passwd /usr/share/man/man1/passwd.1ssl.gz /usr/share/man/man1/passwd.1.gz /usr/share/man/man5/passwd.5.gz
使用which 在PATH变量中查找可执行文件
- PATH变量：路径搜索变量
- 查看变量 echo $变量名
- 路径之间用冒号分割
- 作用：当执行一个（外部）命令程序时，会在PATH变量中查找有无这个程序
┌──(root㉿kali)-[~]
└─# echo $PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/root/.dotnet/tools
┌──(root㉿kali)-[~]
└─# cat /etc/resolv.conf
# Generated by NetworkManager
search localdomain
nameserver 192.168.56.2
┌──(root㉿kali)-[~] type查看命令程序是内部命令还是外部命令
└─# type cat
cat is /usr/bin/cat
┌──(root㉿kali)-[~]
└─# type cd
cd is a shell builtin
┌──(root㉿kali)-[~]
└─# whereis cd
cd:
┌──(root㉿kali)-[~]
└─# which cd
cd: shell built-in command
┌──(root㉿kali)-[~]
└─# which cat
/usr/bin/cat
find 功能强大的find命令
──(root㉿kali)-[~/work/exam]
└─# find --help
Usage: find [-H] [-L] [-P] [-Olevel] [-D debugopts] [path...] [expression]
Default path is the current directory; default expression is -print.
Expression may consist of: operators, options, tests, and actions.
Operators (decreasing precedence; -and is implicit where no others are given):
( EXPR ) ! EXPR -not EXPR EXPR1 -a EXPR2 EXPR1 -and EXPR2
EXPR1 -o EXPR2 EXPR1 -or EXPR2 EXPR1 , EXPR2
Positional options (always true):
-daystart -follow -nowarn -regextype -warn
Normal options (always true, specified before other expressions):
-depth -files0-from FILE -maxdepth LEVELS -mindepth LEVELS
-mount -noleaf -xdev -ignore_readdir_race -noignore_readdir_race
Tests (N can be +N or -N or N):
-amin N -anewer FILE -atime N -cmin N -cnewer FILE -context CONTEXT
-ctime N -empty -false -fstype TYPE -gid N -group NAME -ilname PATTERN
-iname PATTERN -inum N -iwholename PATTERN -iregex PATTERN
-links N -lname PATTERN -mmin N -mtime N -name PATTERN -newer FILE
-nouser -nogroup -path PATTERN -perm [-/]MODE -regex PATTERN
-readable -writable -executable
-wholename PATTERN -size N[bcwkMG] -true -type [bcdpflsD] -uid N
-used N -user NAME -xtype [bcdpfls]
Actions:
-delete -print0 -printf FORMAT -fprintf FILE FORMAT -print
-fprint0 FILE -fprint FILE -ls -fls FILE -prune -quit
-exec COMMAND ; -exec COMMAND {} + -ok COMMAND ;
-execdir COMMAND ; -execdir COMMAND {} + -okdir COMMAND ;
Other common options:
--help 显示此帮助信息并退出
--version output version information and exit
Valid arguments for -D:
exec, opt, rates, search, stat, time, tree, all, help
Use '-D help' for a description of the options, or see find(1)
Please see also the documentation at https://www.gnu.org/software/findutils/.
You can report (and track progress on fixing) bugs in the "find"
program via the GNU findutils bug-reporting page at
https://savannah.gnu.org/bugs/?group=findutils or, if
you have no web access, by sending email to <[email protected]>.
┌──(root㉿kali)-[~/work/exam]
路径 表达式 -type 类型 f ：普通文件 d表示目录 -name 按照文件名称查找，支持通配符
└─# find / -type f -name apache2
/etc/init.d/apache2
/etc/logrotate.d/apache2
/etc/cron.daily/apache2
/usr/lib/php/8.2/sapi/apache2
/usr/share/lintian/overrides/apache2
/usr/sbin/apache2
find: ‘/run/user/1000/gvfs’: 权限不够
┌──(root㉿kali)-[~/work/exam]
└─#
┌──(root㉿kali)-[~/work/exam]
└─# find /etc -type f -name apache2
/etc/init.d/apache2
/etc/logrotate.d/apache2
/etc/cron.daily/apache2
┌──(root㉿kali)-[~/work/exam]
└─# find /etc -type f -name apache2*
/etc/init.d/apache2
/etc/logrotate.d/apache2
/etc/apparmor.d/abstractions/apache2-common
/etc/apache2/apache2.conf
/etc/cron.daily/apache2
┌──(root㉿kali)-[~/work/exam]
└─# find /etc -type f -name apache2?
┌──(root㉿kali)-[~/work/exam]
└─# find /etc -type f -name apache2?????
/etc/apache2/apache2.conf
┌──(root㉿kali)-[~/work/exam]
└─# find /etc -type f -name apache2*.conf
/etc/apache2/apache2.conf
┌──(root㉿kali)-[~/work/exam]
└─# find /etc -type f -name apache?.conf
/etc/apache2/apache2.conf
┌──(root㉿kali)-[~/work/exam]
└─# ls
a b c d kali kalil
┌──(root㉿kali)-[~/work/exam]
└─# find . -name "?"
.
./a
./c
./d
./b
┌──(root㉿kali)-[~/work/exam]
└─# find . -name "[a,b,c]"
./a
./c
./b
快速理解通配符
- * ：任意（0个 or 多个）字符
- ？：单个字符
- []：一个列表,匹配列表中的任意单个字符
┌──(root㉿kali)-[~/work/exam]
└─# ls
a b c d kalia kalib kalil
┌──(root㉿kali)-[~/work/exam]
└─# find . -name kali?
find: paths must precede expression: `kalib'
find: possible unquoted pattern after predicate `-name'?
┌──(root㉿kali)-[~/work/exam]
└─# find . -name " kali?"
┌──(root㉿kali)-[~/work/exam]
└─# find . -name "kali?"
./kalia
./kalib
./kalil
┌──(root㉿kali)-[~/work/exam]
└─# find . -name "[kalia,kalib]"
./a
./b
┌──(root㉿kali)-[~/work/exam]
└─# find . -name "[a,b]"
./a
./b
┌──(root㉿kali)-[~/work/exam]
└─# find . -name "kali[a,b]"
./kalia
./kalib