Linux Command skills

Linux Command skills

1. Check whether the webshell Trojan is placed in the root directory of the site. check whether it is a PHP Trojan script based on the statement. # Find/storage/www/-name "*. php" | xargs grep-in -- color "eval (" # Grep-I -- include = '*. php'-r System \ s * \ (/storage/www/ 2. Analyze the number of times that access logs appear from the same IP address, such as leeching, attacks, and robots # Cat access. log | awk '{print $1}' | sort | uniq-c | sort-Rn 3. analyze the specific data access situation of the most frequently used IP address to the website # Grep-e IP Access. Log> filename # Cat filename | awk '{print $8}' | sort | uniq-c | sort-Rn 4. Obtain the first 20 files or pages with the most visits # Cat access. log | awk '{print $11}' | sort | uniq-c | sort-Nr | head-20 5. List the largest number of EXE files transmitted (commonly used when analyzing download sites) # Cat access. log | awk '($7 ~ /\. EXE/) {print $10 "" $1 "" $4 "" $7} '| sort-Nr | head-20 6. List the EXE files with an output greater than 200000 bytes (about KB) and the number of occurrences of the corresponding files # Cat access. log | awk '($10> 200000 & $7 ~ /\. EXE/) {print $7} '| sort-N | uniq-c | sort-Nr | header-100 7. If the last column of the log records the page file transfer time, the most time-consuming page is listed on the client. # Cat access. log | awk '($7 ~ /\. Php/) {print $ NF "" $1 "" $4 "" $7} '| sort-Nr | head-100 8. List the most time-consuming pages (more than 60 seconds) and the number of corresponding page occurrences # Cat access. log | awk '($ NF> 60 & $7 ~ /\. Php/) {print $7} '| sort-N | uniq-c | sort-Nr | header-100 9. List objects whose transmission time exceeds 30 seconds # Cat access. log | awk '($ NF> 30) {print $7}' | sort-N | uniq-c | sort-Nr | head-20 10. Count website traffic (g) # Cat access. log | awk '{sum + = $10} end {print sum/1024/1024/1024 }' 11. Count connections of 404 # Awk '($9 ~ /404/) 'access. log | awk' {print $9, $7} '| sort 12. collect statistics on HTTP status. # Cat access. log | awk '{counts [$ (9)] + = 1}; end {for (code in counts) Print Code, counts [Code]}' # Cat access. log | awk '{print $9}' | sort | uniq-c | sort-Rn 13. Search for Trojan content for batch cleanup # Find/webbase/-type F-exec grep 'www .800816.com.cn '-l {}\; # Sed-I "s/body {. * www.800816.com.cn. *} // G" 'grep www.800816.com.cn-rl ./' 14. Bulk conversion GBK for UTF-8 file encoding # Find default-type D-exec mkdir-p utf /{}\; # Find default-type F-exec iconv-f gbk-T UTF-8 {}-o utf /{}\; 15. find how to avoid multiple file directories when searching for files # Find/usr/SAM \ (-path/usr/SAM/dir1-o-path/usr/SAM/file1 \)-prune-o-name "*. TXT "-print 16. view the number of concurrent TCP requests and their TCP connection status: # Netstat-N | awk '/^ TCP/{++ s [$ NF]} end {for (a in S) print a, s [a]}' # Netstat-Nat | awk '{print $6}' | sort | uniq-c | sort-Rn # Netstat-N | awk '/^ TCP/{++ State [$ NF]}; end {for (key in State) print key, "\ t ", state [Key]}' # Netstat-N | awk '/^ TCP/{++ arr [$ NF]}; end {for (K in ARR) print K, "\ t ", arr [k]}' # Netstat-N | awk '/^ TCP/{print $ NF}' | sort | uniq-c | sort-Rn # Netstat-ant | awk '{print $ NF}' | grep-V '[A-Z]' | sort | uniq-C 17. Search for the top 20 IP addresses (usually used to find attack sources) # Netstat-anlp | grep 80 | grep TCP | awk '{print $5}' | awk-F: '{print $1}' | sort | uniq-c | sort-Nr | head-N20 # Netstat-ant | awk '/: 80/{split ($5, IP ,":"); + A [IP [1]} end {for (I in a) print a [I], I} '| sort-Rn | head-N10 18. view the number of active PHP-CGI Processes # Netstat-anp | grep PHP-CGI | grep ^ TCP | WC-l 19. Find More time_wait connections # Netstat-N | grep time_wait | awk '{print $5}' | sort | uniq-c | sort-Rn | head-N20 20. Search for more SYN connections # Netstat-an | grep SYN | awk '{print $5}' | awk-F: '{print $1}' | sort | uniq-c | sort-Nr | more 21. Process by port column # Netstat-ntlp | grep 80 | awk '{print $7}' | cut-D/-F1 22. packet capture can be used to analyze data when port 80 is attacked. # Tcpdump-C 10000-I eth0-N DST port 80>/root/Pkts 23. Use tcpdump to sniff access to port 80 to see who is the highest # Tcpdump-I eth0-tnn DST port 80-C 1000 | awk-F ". "'{print $1 ". "$2 ". "$3 ". "$4} '| sort | uniq-c | sort-Nr | head-20 24. Check which crawlers are capturing the content. #/Usr/sbin/tcpdump-I eth0-l-S 0-w-DST port 80 | strings | grep-I User-Agent | grep-I-e 'bot | Crawler | slurp | spider' 25. Collect traffic by region # Zcat squid_access.log.tar.gz | awk '{print $10, $7} '| awk' begin {FS = "[/]"} {trfc [$4] + = $1} end {for (domain in trfc) {printf "% s \ t % d \ n", domain, trfc [domain]}' 26. view the SQL statement executed by the database #/Usr/sbin/tcpdump-I eth0-S 0-L-w-DST port 3306 | strings | egrep-I 'select | update | Delete | insert | set | commit | rollback | create | drop | alter | call' 27. Replace "no" in the matched root row with "yes" # Sed-I '/root/S/no/Yes/'/etc/ssh/sshd_config 28. Remove the first column # Awk '{for (I = 2; I <= NF; I ++) if (I! = NF) {printf $ I ""} else {print $ I} 'list 29. sort by memory size from large to small # Ps-e-o "% C: % P: % Z: % A" | sort-K5-NR 30. sort by CPU utilization from large to small # Ps-e-o "% C: % P: % Z: % A" | sort-NR 31. How to know the CPU on which a process runs # Ps-eo pid, argS, AND SrS 32. Clear dead processes. # Ps-eal | awk '{if ($2 = "Z") {print $4}' | kill-9 33. View hardware manufacturers # Dmidecode-S system-product-name 34. Find the process that occupies the most disk I/O # Wget-C http://linux.web.psi.ch/dist/scientific/5/gfa/all/dstat-0.6.7-1.rf.noarch.rpm # Dstat-M topio-D-M topbio 35. Check whether I/O usage (% util) exceeds 100% # Iostat-x 1 2 36. disk space, check whether there is high partition usage (Use %) (for example, more than 90%) If you find that a partition space is close to exhausted, you can enter the mount point of the partition, run the following command to find the most occupied files or directories: # DF-H # Du-CKS * | sort-Rn | head-N 10 37. Check whether the first three output values of the CPU load have exceeded 4 times the system logic CPU. # Cat/proc/loadavg 38. Number of CPUs # Cat/proc/cpuinfo | grep-C Processor 39. Check whether the network traffic (rxbyt/s, txbyt/s) is too high. # Sar-N Dev 40. The network traffic is displayed every one second. # Watch-N 1 "/sbin/ifconfig eth0 | grep bytes" 41. to overwrite files in the directory in batches, you do not need to determine whether to execute them. # \ CP-RF/SVN/wwwroot 42. debug commands # Strace-P PID 43. Trace the PID of a specified process # GDB-P PID 44. view the number of file handles opened by the current process Lsof-N | awk '{print $2}' | sort | uniq-c | sort-Nr | more