On this page 15 sections
  1. What grep does
  2. Ignore case and show line numbers
  3. Recursive searches
  4. Exact strings
  5. Match whole words or complete lines
  6. Invert matches
  7. Extended regular expressions
  8. Print only the matching part
  9. Context around matches
  10. Count results
  11. List only matching filenames
  12. Include and exclude files
  13. Search several patterns
  14. Read patterns from a file
  15. Useful pipelines
Lab use only. Apply these techniques only to systems you own or have explicit permission to test.
01

What grep does

grep searches input for lines matching a pattern. It can read files, standard input or entire directory trees and supports both simple strings and regular expressions.

Basic search
grep "error" application.log
02

Ignore case and show line numbers

-i makes matching case-insensitive, while -n prints the line number of every match.

Case-insensitive search
grep -i "error" application.log
Show line numbers
grep -n "Failed password" /var/log/auth.log
Combine options
grep -in "warning" application.log
03

Recursive searches

-r searches recursively through directories. -R behaves similarly but follows symbolic links.

Search configuration tree
grep -r "password" /etc 2>/dev/null
Show filename and line number
grep -rin "api_key" /var/www 2>/dev/null
04

Exact strings

-F treats the search pattern as a fixed string instead of a regular expression. This is safer and faster when searching for text containing regex characters.

Literal string
grep -F "10.20.20.10" access.log
05

Match whole words or complete lines

-w restricts matches to whole words while -x requires the complete line to match.

Whole word
grep -w "root" /etc/passwd
Exact line
grep -x "PermitRootLogin no" /etc/ssh/sshd_config
06

Invert matches

-v returns lines that do not match the pattern. This is useful for removing noise from command output.

Remove comments
grep -v "^#" /etc/ssh/sshd_config
Remove comments and blank lines
grep -Ev "^\s*(#|$)" /etc/ssh/sshd_config
07

Extended regular expressions

-E enables extended regex syntax, including alternatives with | and grouping with parentheses.

Match errors or warnings
grep -Ei "error|warning|critical" application.log
IPv4-like patterns
grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}' access.log
08

Print only the matching part

-o outputs only the text that matched rather than the entire line. This is extremely useful when extracting IPs, domains, hashes or identifiers.

Extract IPv4 addresses
grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}' access.log
Extract sam0x.me hostnames
grep -Eo '([A-Za-z0-9_-]+\.)*sam0x\.me' urls.txt
09

Context around matches

-A prints lines after a match, -B prints lines before and -C prints both directions.

Three lines after match
grep -A 3 "ERROR" application.log
Two lines before match
grep -B 2 "connection refused" application.log
Context around match
grep -C 3 "panic" application.log
10

Count results

-c returns the number of matching lines. When combined with multiple files it prints a count per file.

Count failed SSH attempts
grep -c "Failed password" /var/log/auth.log
11

List only matching filenames

-l prints the files containing at least one match. -L does the opposite and prints files without matches.

Files containing password
grep -ril "password" /var/www 2>/dev/null
Config files without directive
grep -L "ServerName" /etc/apache2/sites-enabled/*
12

Include and exclude files

Recursive searches can be restricted by filename using --include or --exclude. Entire directory trees can be removed with --exclude-dir.

Search only PHP files
grep -rin --include="*.php" "password" /var/www
Ignore logs
grep -rin --exclude="*.log" "sam0x" /opt
Ignore node_modules
grep -rin --exclude-dir=node_modules "API_KEY" .
13

Search several patterns

-e can be repeated to specify several independent search patterns.

Multiple patterns
grep -e "ERROR" -e "CRITICAL" -e "FATAL" application.log
14

Read patterns from a file

-f loads one search pattern per line from another file. This is useful when maintaining larger lists of indicators or keywords.

Search using pattern list
grep -f indicators.txt access.log
15

Useful pipelines

grep becomes especially useful when filtering the output of other commands. It is commonly combined with ps, ss, journalctl, find and command histories.

Find SSH processes
ps aux | grep "[s]sh"
Filter listening sockets
ss -lntp | grep ":443"
Kernel errors
journalctl -k | grep -i "error"