Linux › Module 5 › Lesson 3
find, which, and locate
Find files and binaries with find, which, and locate
Opening
Where did that file go?
Attackers drop tools in /tmp. Admins lose configs. find walks the filesystem. which tells you what binary runs. locate searches a pre-built index—fast, but not always installed.
1. which — Which Binary Runs?
which python3 which ssh Shows the path from your PATH variable. Useful when you wonder if you are running the real ssh or a trojan in /tmp.
2. find — Powerful Search
find /home -name "*.txt" find / -type f -name "id_rsa" 2>/dev/null find /tmp -type f -perm -o+w — world-writable files in /tmp 2>/dev/null hides permission errors when searching from /.
3. locate — Fast Index
locate nginx.conf sudo updatedb — refresh index (run occasionally) Great for quick hunts; find is more precise and live.
CTF / privesc hint
find / -perm -4000 2>/dev/null lists SUID binaries—common privilege-escalation targets in labs. Only run on systems you are authorized to test.
Knowledge Check
which command shows:
Multiple choice
Knowledge Check
find /home -name "*.log" searches for:
Multiple choice
Knowledge Check
Why redirect find errors with 2>/dev/null when searching from /?
Multiple choice