Viewing & Editing Files

Reading files efficiently is one of the most fundamental skills in security work - whether you're combing through a web app's source code, tailing a log file during an active incident, or carving a config file for hardcoded credentials.

cat - Dump a File to Screen

cat (concatenate) reads one or more files and prints them to standard output. It's the quick-and-dirty way to read a file.

Useful cat flags:

• -n - number every output line
• -A - show non-printing characters (tabs as ^I, line endings as $) - helpful for debugging config files
• -s - squeeze consecutive blank lines into one

cat is bad for large files - it dumps everything at once. For anything over a few hundred lines, use less.

Concatenating multiple files:

cat file1.txt file2.txt > combined.txt   # merge two files
cat >> log.txt                           # append stdin to a file (Ctrl+D to stop)

tac - Reverse cat

tac prints a file in reverse order (last line first). The name is cat backwards, which is exactly what it does.

tac is handy when you want the most recent log entries without knowing the exact line numbers (before using tail).

less and more - Paged Reading

For large files, you need a pager - a program that shows content one screen at a time.

less is the modern, feature-rich version. more is older and simpler. Always use less.

less /var/log/syslog
less /usr/share/wordlists/rockyou.txt

Essential less keybindings:

head and tail - Reading Specific Portions

head shows the beginning of a file; tail shows the end.

The default is 10 lines. Use -n NUMBER (or just -NUMBER) to change it:

head -50 bigfile.txt       # first 50 lines
tail -100 /var/log/syslog  # last 100 lines

tail -f - Live Log Monitoring

-f (follow) makes tail watch the file and print new lines as they're written. This is invaluable for real-time monitoring:

Those three rapid-fire failures from the same IP? That's a brute-force attempt. tail -f /var/log/auth.log is one of the first commands an incident responder runs.

tail -f /var/log/apache2/access.log   # watch web traffic in real time
tail -f /var/log/syslog               # general system activity
tail -f /var/log/auth.log             # authentication events

nano - Beginner-Friendly Editor

nano is the approachable terminal text editor. It shows keyboard shortcuts at the bottom of the screen - no memorization needed to get started.

nano /etc/hosts
nano newfile.txt

Key nano shortcuts (shown as ^ = Ctrl, M- = Alt/Esc):

vim - Just Enough to Survive

vim (Vi IMproved) is everywhere: minimal Docker containers, embedded systems, old servers. It will be the only editor available on many systems you encounter. The learning curve is steep, but you only need to know a handful of things:

The critical concept: vim has modes.

• Normal mode - default when you open vim. Keys execute commands, not type text. dd deletes a line, yy copies it, /pattern searches.
• Insert mode - type text like a normal editor. Press i to enter.
• Command mode - enter commands with :. Press Esc then : to enter.
• Visual mode - select text. Press v to enter.

Getting stuck in vim is a meme. Here's how to never be stuck:

Press Esc (always safe - returns to Normal mode)
Type :q!  then Enter → Quit WITHOUT saving (the lifesaver)
Type :wq  then Enter → Write (save) and Quit
Type :w   then Enter → Save without quitting

The minimum vim workflow:

vim filename     → open file in Normal mode
i                → enter Insert mode (now you can type)
(type your changes)
Esc              → return to Normal mode
:wq Enter        → save and exit

Useful Normal mode commands:

file - What Type Is This?

file examines a file's content and reports its type - ignoring the filename extension entirely:

In security work, file is essential because attackers and malware often rename files to disguise them. An .exe disguised as a .jpg, a shell script with no extension, a binary dropped in /tmp with a misleading name - file looks at the actual magic bytes and tells you the truth.

stat - File Metadata

stat shows detailed metadata about a file: permissions, ownership, all three timestamps, inode number, and more.

The three timestamps matter for forensics:

• Access (atime) - last time the file was read
• Modify (mtime) - last time the file contents changed
• Change (ctime) - last time the file metadata changed (permissions, ownership, name)

Searching Inside Files - grep

While not strictly a "viewing" tool, grep is inseparable from file viewing in practice. It filters lines matching a pattern:

grep "Failed password" /var/log/auth.log
grep -i "error" /var/log/syslog          # case-insensitive
grep -r "password" /var/www/             # recursive through directory
grep -v "^#" /etc/ssh/sshd_config        # exclude comment lines
grep -n "root" /etc/passwd               # show line numbers
grep -E "admin|root|superuser" /etc/passwd  # extended regex

That pipeline - grep for failed passwords, extract IPs, count unique occurrences, sort by frequency - is the kind of one-liner that turns a raw log file into an actionable threat intelligence report.

Key Takeaways

• cat dumps files to screen; use it for small files and piping. less is better for large files - it lets you scroll, search, and navigate.
• head and tail read beginnings and ends of files. tail -f follows a log file in real time - essential for incident monitoring.
• nano is beginner-friendly with on-screen shortcuts. Know it for quick edits.
• vim survival kit: Esc + :q! to quit without saving; i to enter insert mode; Esc + :wq to save and quit.
• file reveals a file's true type by reading magic bytes - don't trust extensions.
• stat shows detailed metadata including all three timestamps, which matter for forensic timelines.
• grep filters file contents by pattern and is the foundation of log analysis and credential hunting.