Text Manipulation &
Searching for Information
• Filtering text with grep, sed
• Viewing files with more and less
If the version of Kali Linux you’re using doesn’t come
preinstalled with Snort, you
can download the files from the Kali repository by entering
sudo apt-get install snort.
VIEWING FILES IN LINUX
1. Displaying Entire File
• Use cat to display the whole file
2. Viewing the Beginning of a File
• Use head to show the first 10 lines
• To show a specific number of lines (e.g., 20)
3. Viewing the End of a File
• Use tail to show the last 10 lines
• To show the last 20 lines
4. Displaying Line Numbers
• Use nl to show the file with line numbers
FILTERING TEXT WITH GREP
1. Searching for a Keyword in a File
• To find all lines containing the word "output" in [Link]
2. Using cat with grep (Not Recommended)
• Works but is unnecessary because grep can directly read files
• Instead, you can just use the first command… (Dw I still use this one)
3. Searching Case-Insensitive (-i)
• To find "output" regardless of letter case (e.g., output, OUTPUT):
• The grep command can be used for a lot more stuff… research
Hacker Challenge: Using grep, nl, tail, and head
• Goal: Display the five lines before # Step #6: Configure output plugins
• Commands Used: grep, nl, tail, head
• Way_1: grep -B 5 "# Step #6: Configure output plugins“ /etc/snort/[Link]
• Way_2:
1. grep -n “# Step #6: Configure output plugins” /etc/snort/[Link]
2. nl /etc/snort/[Link] | head -n 544| tail -n 6
• Now your challenge is to do the same but another way… hehehe
Hacker Challenge: Using grep, nl, tail, and head
• If you remember, during the session, I wasn’t getting the desired output, I realized
the mistake. nl does not print the line numbers of empty lines so instead of line 544,
I was getting line 459… (I loved grep but this is turning into marriage soon)
USING SED TO FIND AND REPLACE
The sed command allows you to search for a word or pattern and replace it.
1. Basic Find and Replace
• To replace "mysql" with "MySQL" in [Link] and save the output to [Link]
• s/old_word/new_word/g → Replaces all occurrences of “mysql” with “MySQL”
• > → Saves the output to a new file.
2. Replace Only the First Occurrence
• To replace only the first occurrence per line
3. Replace a Specific Occurrence
• To replace only the second occurrence per line
• sed makes text replacement fast and efficient!
VIEWING FILES WITH MORE AND LESS
For large files, cat isn’t practical. Instead, use more or less.
1. Using more
• To view a file one page at a time
• Press ENTER to scroll line by line.
• Press q to quit.
2. Using less – most powerful out of both
• To scroll and search within a file ( less /etc/snort/[Link])
• Use ↑ ↓ to scroll.
• Press /, type a word, and press ENTER to search.
• Press n to find the next match.
• Press q to quit.
TIME TO PRACTICE THEM ALL!!!
The best way to become comfortable with using the terminal is to try out
your newfound skills pretty much.
EXERCISE
Before you move on to the next session, try out the skills you learned from this
session by completing the following exercises:
1. Navigate to /usr/share/wordlists/metasploit. This is a directory of multiple
wordlists that can be used to brute force passwords in various password protected
devices using Metasploit, the most popular pentesting and hacking framework.
2. Use the cat command to view the contents of the file [Link]
3. Use the more command to display the file [Link]
4. Use the less command to view the file [Link]
5. Now use the nl command to place line numbers on the passwords in [Link].
There should be 88,396 passwords.
6. Use the tail command to see the last 20 passwords in [Link]
7. Use the cat command to display [Link] and pipe it to find all the passwords
that contain 123.