A standalone python3 remake of the basic “tree” command with the extra characteristic of trying to find consumer offered key phrases/regex in recordsdata, highlighting those who comprise matches. Created for 2 most important causes:
- Whereas trying to find secrets and techniques in recordsdata of nested listing buildings, with the ability to visualize which recordsdata comprise consumer offered key phrases/regex patterns and the place these recordsdata are situated within the hierarchy of folders, gives a major benefit.
- “tree” is an incredible instrument for analyzing listing buildings. It is actually helpful to have a standalone different of the command for post-exploitation enumeration as it’s not pre-installed on each linux distro and is form of restricted on Home windows (in comparison with the UNIX model).
Utilization Examples
Instance #1: Working a regex that basically matches strings just like: password = one thing
towards /var/www
Instance #2: Utilizing comma separated key phrases as an alternative of regex:
Disclaimer: Solely examined on Home windows 10 Professional.
Additional Choices & Utilization Ideas
Notable options:
- Regex
-x
search really returns a novel checklist of all matched patterns in a file. Watch out when combining it with-v
(–verbose), attempt to be particular and restrict the size of chars to match. - You possibly can search key phrases/regex in binary recordsdata as nicely by offering possibility
-b
. - You need to use this instrument because the basic “tree” command if you don’t present key phrases
-k
and regex-x
values. That is helpful in case you’ve got gained a restricted shell on a machine and wish to have “tree” with coloured output to go searching. - There is a checklist variable
filetype_blacklist
ineviltree.py
which can be utilized to exclude sure file extensions from content material search. By default, it excludes the next:gz, zip, tar, rar, 7z, bz2, xz, deb, img, iso, vmdk, dll, ovf, ova
. - A fairly helpful characteristic is the
-i
(–interesting-only) possibility. It instructs eviltree to checklist solely recordsdata with matching key phrases/regex content material, considerably decreasing the output size:
Helpful key phrases/regex patterns
- Regex to search for passwords:
-x ".{0,3}passw.{0,3}[=]{1}.{0,18}"
- Key phrases to search for delicate information:
-k passw,db_,admin,account,consumer,token