cut — Extract Columns
What is cut?
cut extracts sections from each line — by delimiter (like :) or by character position. Simpler than awk when you only need one field.
OSCP use: Pull usernames from
/etc/passwd, extract port numbers, get specific CSV columns.
Syntax
cut [OPTIONS] [FILE]
command | cut [OPTIONS]📌 Flags
| Flag | Description |
|---|---|
-d CHAR | Delimiter (default: TAB) |
-f LIST | Fields to extract (1-based): -f1, -f1,3, -f1-3 |
-c LIST | Characters by position: -c1-5 |
-b LIST | Bytes by position |
--complement | Invert selection |
📌 Examples
# /etc/passwd — usernames (field 1, colon-separated)
cut -d: -f1 /etc/passwd
# UID (field 3)
cut -d: -f3 /etc/passwd
# Username + home dir (fields 1 and 6)
cut -d: -f1,6 /etc/passwd
# First 5 characters of each line
cut -c1-5 file.txt
# From pipe — nmap port extraction
grep "^[0-9]" ports.txt | cut -d'/' -f1
# CSV
cut -d, -f2 data.csv📌 OSCP Examples
# Interactive users (with grep)
grep -v "nologin\|false" /etc/passwd | cut -d: -f1
# Nmap allports → port list
cat allports.txt | grep "^[0-9]" | cut -d'/' -f1
# Extract 2nd column from whitespace output
ps aux | cut -c1-50📌 cut vs awk
| Use | Tool |
|---|---|
| Simple delimiter split, one field | cut |
| Conditional logic, multiple rules | awk |
| Last field, regex patterns | awk |
📌 Quick Cheat Sheet
cut -d: -f1 /etc/passwd
cut -d: -f1,3 /etc/passwd
cut -d'/' -f1 file.txt
cut -c1-10 file.txt
grep pat file | cut -d, -f2