6.2 Finding Files: find
find /var/www -name "*.html" # by name
find / -iname "nginx.conf" 2>/dev/null # case-insensitive, hide permission errors
find /var/log -type f -size +100M # files bigger than 100 MB
find /tmp -type f -mtime +7 # modified more than 7 days ago
find /tmp -type f -mtime +7 -delete # ...and delete them
find /var/www/html -type d -exec chmod 755 {} \; # run a command on each result
find . -type f -name "*.log" | xargs ls -lh
find / -perm -o+w -type f 2>/dev/null | grep -v /proc # world-writable files
find /var/www -name "*.php" -mmin -60 # PHP files changed in last hour
find / -name "id_rsa*" 2>/dev/null # stray private keys
Why this matters for security
Attackers use find to hunt for SUID binaries, writable files and keys. Incident responders use -mmin/-mtime to find web shells and files changed around the time of an attack.
Ravindra Bagale's Tip
find ... -delete kiwa -exec rm direct chalvu naka. Khup students ne chukiche folder saaf kele aahet. Aadhi -delete shivay chalva, list bagha, khatri zali ki mag -delete jooda.
Practice task
Find all .conf files under /etc modified in the last 7 days, and all files larger than 50 MB anywhere on the system.