Welcome back to Linux Command Line Hackery, hope you have enjoyed this series so far. Today we are going to learn new Linux commands and get comfortable with reading text files on Linux.
Suppose that you wanted to view your /etc/passwd file. How will you do that? From what we have learned so far what you'll do is type:
cat /etc/passwdAnd there you go, but really did you see all the output in one terminal? No, you just ended up with last few lines and you'll have to cheat (i,e use graphical scroll bar) in order to see all the contents of /etc/passwd file. So is there a command line tool in linux with which we can see all the contents of a file easily without cheating? Yes, there are actually a few of them and in this article we'll look at some common ones.
Command:
moreSyntax:
more [options] file...Function: more is a filter for paging through text one screenful at a time. With more we can parse a file one terminal at a time or line by line. We can also go backward and forward a number of lines using more.
So if we're to use more on /etc/passwd file how will we do that? We'll simply type
more /etc/passwdnow we'll get a screenful output of the file and have a prompt at the bottom of terminal. In order to move forward one line at a time press
<Enter Key>. Using enter we can scroll through the file one line at a time. If you want to move one screen at a time, you can press
<Space Key> to move one screen at a time. There are more functions of more program, you can know about them by pressing
<h key>. To exit out of more program simply type
<q key> and you'll get out of more program.
Command:
lessSyntax:
less [options] file...Function: less is similar to more but less has more functionality than more. less is particularly useful when reading large files as less does not have to read the entire input file before starting, so it starts up quickly than many other editors.
less command is based on more so what you've done above with more can be done with less as well. Try it out yourself.
Command:
headSyntax:
head [OPTION]... [FILE]...Function: head command prints the head or first part of a file. By default head prints out first 10 lines of a file. If more than one file is specified, head prints first 10 lines of all files as a default behavior.
If we want to see only first 10 lines of /etc/passwd we can type:
head /etc/passwdWe can also specify to head how many lines we want to view by using the
-n flag. Suppose you want to see first 15 lines of /etc/passwd file you've to type:
head -n 15 /etc/passwdOk you can view the first lines of a file what about last lines, is there a tool for that also? Exactly that's what our next command will be about.
Command:
tailSyntax:
tail [OPTION]... [FILE]...Function: tail is opposite of head. It prints the last 10 lines of a file by default. And if more than one file is specified, tail prints last 10 lines of all files by default.
To view last 10 lines of /etc/passwd file you'll type:
tail /etc/passwdand as is the case with head
-n flag can be used to specify the number of lines
tail -n 15 /etc/passwdNow one more thing that we're going to learn today is
grep.
Command:
grepSyntax:
grep [OPTIONS] PATTERN [FILE...]Function: grep is used to search a file for lines matching the pattern specified in the command.
A
PATTERN can simply be a word like "hello" or it can be a regular expression (in geek speak regex). If you aren't familiar with regex, it's ok we'll not dive into that it's a very big topic but if you want to learn about it I'll add a link at the end of this article that will help you get started with regex.
Now back to grep say we want to find a line in /etc/passwd file which contains my user if we'll simply type:
grep myusername /etc/passwd
Wohoo! It gives out just that data that we're looking for. Remember here myusername is your username.
One cool flag of grep is -v which is used to look in file for every line except the line containing the PATTERN specified after -v [it's lowercase v].
Take your time practicing with these commands especially grep and more. We'll learn a lot more about grep in other upcoming articles.
References:
https://en.wikipedia.org/wiki/Regular_expressionhttp://www.regular-expressions.info/Awesome website to learn Regular expressions -
http://www.regexr.com/
"MANDIANT Memoryze is free memory forensic software that helps incident responders find evil in live memory. Memoryze can acquire and/or analyze memory images, and on live systems can include the paging file in its analysis." read more...
