GIAC
GCIH · Question #506
Which of the following files would an attacker alter to remove evidence of the most recently typed commands on a Linux system?
The correct answer is B. .bash_history. Attackers also delete or edit their shell history files, which contain a list of the most recent N commands. For example, the file ~/.bash_history holds commands typed into the bash shell.
Vulnerability Exploitation & Privilege Escalation
Question
Which of the following files would an attacker alter to remove evidence of the most recently typed commands on a Linux system?
Options
- A/root/shell
- B.bash_history
- C/tmp
- Duser_commands
How the community answered
(31 responses)- B94% (29)
- C3% (1)
- D3% (1)
Explanation
Attackers also delete or edit their shell history files, which contain a list of the most recent N commands. For example, the file ~/.bash_history holds commands typed into the bash shell.
Topics
#bash_history#anti-forensics#Linux log tampering#evidence removal
Community Discussion
No community discussion yet for this question.