grep — Search & Filter Lines
What is grep?
grep (Global Regular Expression Print) prints lines that match a pattern. It’s the first tool in almost every filter chain.
OSCP use: Hunt passwords in configs, filter nmap output, extract relevant lines from logs before passing to
awkorcut.
Syntax
grep [OPTIONS] PATTERN [FILE...]
command | grep PATTERN📌 Common Flags
| Flag | Description |
|---|---|
-i | Case insensitive |
-v | Invert — show lines that do NOT match |
-r / -R | Recursive — search directories |
-n | Show line numbers |
-l | List filenames only (files containing match) |
-L | List filenames that do not contain match |
-c | Count matching lines per file |
-w | Match whole word only |
-x | Match whole line only |
-E | Extended regex (egrep) — +, ?, | |
-P | Perl regex (PCRE) — lookaheads, etc. |
-A N | Show N lines after match |
-B N | Show N lines before match |
-C N | Show N lines before and after |
-o | Print only the matching part |
--color=auto | Highlight matches (often default) |
-m N | Stop after N matches |
-e PATTERN | Specify pattern (useful for patterns starting with -) |
-f FILE | Read patterns from file |
📌 Basic Usage
# Search a file
grep "password" config.php
grep -i "admin" access.log
# Search recursively
grep -r "password" /var/www/
grep -rni "secret" /etc/ 2>/dev/null
# Invert — exclude lines
grep -v "nologin" /etc/passwd
grep -v "false\|nologin" /etc/passwd
# List files containing match
grep -rl "password" /var/www/ 2>/dev/null
# Count matches
grep -c "Failed password" /var/log/auth.log
# From pipe
cat access.log | grep "404"
nmap -p- TARGET | grep "^[0-9]"📌 Regex Examples
# OR (extended regex)
grep -E "password|passwd|secret" config.xml
# Lines starting with digit (nmap ports)
grep "^[0-9]" ports.txt
# IP address pattern (basic)
grep -E "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" log.txt
# Extract matching part only
grep -oE "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" log.txt
# Context around match
grep -C 3 "database" config.php📌 OSCP Examples
# Find config files with passwords
grep -rni "password\|passwd\|db_pass" /var/www/ 2>/dev/null
# Interactive users only
grep -v "nologin\|false" /etc/passwd
# Failed SSH logins
grep "Failed password" /var/log/auth.log
# Filter nmap open ports
grep "/tcp.*open" nmap.txt
# Chain to awk
grep "jab.htb" xmpp.txt | awk -F@ '{print $1}'📌 Quick Cheat Sheet
grep "pattern" file.txt
grep -ri "password" /path/ 2>/dev/null
grep -v "exclude" file.txt
grep -rl "pattern" /dir/
grep -E "pat1|pat2" file.txt
grep -o "extract-this" file.txt
cat file | grep "pattern"📌 Windows equivalents (findstr / Select-String)
On Windows, the closest equivalents to grep are findstr (CMD) and PowerShell Select-String.
PowerShell (recommended — closest to grep -Ein)
Select-String -Path .\all-utf8.txt `
-Pattern "password|passwd|secret|token|apikey|api_key|ssh|PRIVATE KEY|INSERT INTO|CREATE DATABASE|CREATE TABLE|admin|user|login" `
-AllMatches -CaseSensitive:$false
# With line numbers
Select-String -Path .\all-utf8.txt `
-Pattern "password|passwd|secret|token|apikey|api_key|ssh|PRIVATE KEY|INSERT INTO|CREATE DATABASE|CREATE TABLE|admin|user|login" `
-AllMatches -CaseSensitive:$false | Format-Table LineNumber, Line -AutoSizeCMD (findstr)
findstr /I /N /R "password passwd secret token apikey api_key ssh admin user login PRIVATE CREATE INSERT" all-utf8.txt| Linux | Windows |
|---|---|
grep -i | findstr /I or Select-String -CaseSensitive:$false |
grep -n | findstr /N or Format-Table LineNumber |
grep -E "a|b" | findstr /R or Select-String -Pattern "a|b" |
grep -r | Get-ChildItem -Recurse | Select-String → gci |
→ Windows CMD - Powershell Commands · gci