The find Command in Linux: Practical Examples and Security Auditing

find is one of those commands that looks simple until you need it at 2am on a production box: locate a config file, find logs eating disk space, or hunt down files with dangerous permissions. It searches the filesystem by name, type, size, time, and permissions — and once you know the syntax, it beats clicking through a file manager every single time.

This guide covers the patterns you'll actually use, including the security angle: find is also how admins (and yes, attackers during privilege escalation) locate misconfigured files.

The basic shape

find <where> <conditions> <action>

• where — the directory to start from (. for here, / for everything)
• conditions — name, type, size, age, permissions
• action — print the path (default), delete, or run a command on each match

Finding files by name

find /etc -name "*.conf"          # all .conf files under /etc
find / -name "nginx.conf" 2>/dev/null   # exact file, hide permission errors
find . -iname "readme*"           # case-insensitive

The 2>/dev/null trick matters when searching from / — otherwise your results drown in "Permission denied" noise.

By type, size, and age

find /var -type d -name "log*"        # directories only
find /var/log -type f -size +100M     # files over 100 MB — disk-space detective work
find /home -type f -mtime -7          # modified in the last 7 days
find /tmp -type f -mmin +60           # not modified in the last hour
find . -type f -empty                 # empty files

-mtime -7 means less than 7 days old; -mtime +30 means older than 30 days. That plus/minus sign trips everyone up at first.

Running commands on results: -exec

This is where find becomes a power tool:

find /var/log -name "*.log" -exec ls -lh {} \;
find . -name "*.tmp" -delete
find /var/log -name "*.gz" -mtime +90 -delete    # clean old rotated logs

{} is the placeholder for each found path, and \; ends the command. Use -exec ... + instead of \; to batch paths into fewer command invocations — much faster on large result sets.

Prefer xargs for pipelines:

find . -name "*.log" | xargs grep -l "ERROR"
find . -type f -name "*.sh" | xargs chmod +x

The security angle: permissions and privilege escalation

Admins use find to audit dangerous permissions; penetration testers use the exact same commands during privilege escalation. Knowing both sides makes you better at defense.

World-writable files — anything any user can modify is a risk:

find / -type f -perm -0002 2>/dev/null

SUID binaries — programs that run as their owner (often root) regardless of who executes them:

find / -perm -4000 -type f 2>/dev/null

A legitimate SUID list is short: passwd, sudo, su, a few others. An unexpected entry — say, a copy of bash in /tmp — is a red flag. SUID on a script is ignored by Linux, but SUID on a misconfigured binary is a classic root path.

Files owned by a specific user, useful when auditing a compromised account:

find / -user www-data -type f 2>/dev/null

If you find a suspicious SUID binary, remove the bit rather than guessing: chmod u-s /path/to/binary.

Handy one-liners to keep

find . -type f | wc -l                      # count files recursively
find / -xdev -type f -size +500M 2>/dev/null   # huge files, stay on one filesystem
find . -newer /etc/hostname -type f         # files changed after a reference file

Once these stick, find stops being a command you look up and becomes the fastest way to answer "where is that file and what is it doing."