Re:Detecting the use of “curl – bash” server side
by gerbilly on Wednesday April 20, 2016 @08:47PM
(#11538875)
I often do this to find out what files were installed where.
$ touch now
$ install.sh
$ find / -newer now
That is supposing you trust install.sh of course.
You can redirect the output of find to a file for later removal. You will have to filter out false positives from the 'find' output, usually dev nodes.
You can redirect the output of find to a file for later removal. You will have to filter out false positives from the 'find' output, usually dev nodes.