bash 7 lines · 1 tab

Linux privilege escalation checks for suspicious local state

Kai Nakamura Apr 2026

1 tab

#!/usr/bin/env bash
set -euo pipefail

find / -perm -4000 -type f 2>/dev/null | sort
sudo -l
find /etc/systemd/system -type f -writable 2>/dev/null
getcap -r / 2>/dev/null

1 file · bash Explain with highlit

Privilege escalation detection is rarely one command. I look for unexpected SUID binaries, writable service units, dangerous sudo rules, and kernel or package drift. These checks are not glamorous, but they catch a lot of real misconfigurations that attackers abuse quickly.

Related snips

python

import os
import stat

for root, _dirs, files in os.walk('/etc'):
    for name in files:
        path = os.path.join(root, name)

Python security audit script for exposed risky filesystem state

python auditing host-security

by Kai Nakamura 1 tab

plaintext

Protocol 2
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
AllowUsers deploy ops

SSH daemon hardening and key based access only

ssh linux hardening

by Kai Nakamura 1 tab

plaintext

bind 127.0.0.1 10.0.0.15
protected-mode yes
port 6379
rename-command FLUSHALL ""
rename-command CONFIG ""
aclfile /etc/redis/users.acl

Redis hardening with ACLs protected mode and network isolation

redis hardening infrastructure

by Kai Nakamura 1 tab

typescript

import crypto from 'crypto';
import helmet from 'helmet';
import type { Express, Request, Response, NextFunction } from 'express';

function cspNonce(req: Request, res: Response, next: NextFunction): void {
  res.locals.cspNonce = crypto.randomBytes(16).toString('base64');

Security headers with helmet (baseline hardening)

security express helmet

by codesnips 3 tabs

bash

#!/usr/bin/env bash
set -euo pipefail

OUT="/tmp/incident-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$OUT"

Forensic collection script for volatile host evidence

forensics incident-response linux

by Kai Nakamura 1 tab

ruby

class Current < ActiveSupport::CurrentAttributes
  attribute :user, :tenant, :request_id, :ip_address

  def user_display
    user&.email || "system"
  end

CurrentAttributes for Request-Scoped Context

rails activesupport currentattributes

by codesnips 4 tabs

Share this code

Here's the card — post it anywhere.

Linux privilege escalation checks for suspicious local state — share card

Link copied