rsync — file synchronization and remote enumeration

rsync synchronizes files and directories locally or between systems. It only transfers differences when possible, making it efficient for backups, deployments and remote file transfers.

Archive mode (-a) recursively copies directories while preserving common metadata such as permissions, timestamps and symbolic links. It is the most common starting point for rsync operations.

-v shows which files are being processed. It is commonly combined with archive mode.

The trailing slash on the source changes what rsync copies. source/ means copy the contents of the directory, while source means copy the directory itself.

--progress displays transfer progress for individual files. --info=progress2 provides an overall progress view for the transfer.

--dry-run shows what rsync would change without actually modifying files. It is especially useful before destructive synchronization operations.

rsync commonly uses SSH for encrypted remote transfers. The remote destination follows the user@host:path format.

The -e option allows the SSH command used by rsync to be customised.

A specific SSH private key can be selected through the SSH command passed with -e.

--exclude prevents selected files or directories from being transferred.

--include and --exclude can be combined to restrict synchronization to selected file patterns.

--delete removes destination files that are absent from the source. This creates a closer mirror but can destroy data if the source or destination is wrong. Always consider a dry run first.

--partial keeps partially transferred files instead of deleting them when a transfer is interrupted.

-h displays file sizes in a more readable format.

-z compresses file data while it is being transferred. It can help on slower links but may provide little benefit for files that are already compressed.

--bwlimit limits transfer bandwidth in KiB per second and can prevent rsync from consuming an entire connection.

Normally rsync determines whether files changed using size and modification time. -c forces checksum comparison, which is more thorough but consumes additional CPU and disk I/O.

rsync can also run as a network daemon, commonly on TCP port 873. In daemon mode, directories are exposed as named modules instead of using SSH paths.

If a module permits listing, its contents can be viewed without downloading anything.

In authorised CTF or lab environments, a readable module can be copied locally for offline inspection.

A recursive listing is useful before downloading a large module because it shows its directory structure and potentially interesting filenames.

When a readable rsync module is exposed in a lab, configuration files, backups, SSH material, scripts and application files are usually more interesting than blindly downloading everything.

The traditional rsync daemon listens on TCP port 873. An open port does not automatically mean anonymous access is permitted, but it indicates that rsync daemon enumeration may be relevant.

user@host:/path normally indicates rsync transported through SSH, usually using TCP 22. host::module or rsync://host/module refers to rsync daemon mode, commonly using TCP 873.

For many everyday backup tasks, archive mode, human-readable output and progress provide a good combination.

For SSH-based synchronization, archive mode together with progress gives a simple and reliable starting point.

In an authorised lab, first identify whether TCP 873 is exposed, list available modules, inspect a relevant module recursively and only then copy interesting data locally.