Kali Linux

EvilTree : A Remake Of The Classic “Tree” Command

EvilTree is a standalone python3 remake of the classic “tree” command with the additional feature of searching for user provided keywords/regex in files, highlighting those that contain matches. Created for two main reasons:

  • While searching for secrets in files of nested directory structures, being able to visualize which files contain user provided keywords/regex patterns and where those files are located in the hierarchy of folders, provides a significant advantage.
  • “tree” is an amazing tool for analyzing directory structures. It’s really handy to have a standalone alternative of the command for post-exploitation enumeration as it is not pre-installed on every linux distro and is kind of limited on Windows (compared to the UNIX version).

Usage Examples

Example #1: Running a regex that essentially matches strings similar to: password = something against /var/www

Example #2: Using comma separated keywords instead of regex:

Disclaimer: Only tested on Windows 10 Pro.

Further Options & Usage Tips

Notable features:

  • Regex -x search actually returns a unique list of all matched patterns in a file. Be careful when combining it with -v (–verbose), try to be specific and limit the length of chars to match.
  • You can search keywords/regex in binary files as well by providing option -b.
  • You can use this tool as the classic “tree” command if you do not provide keywords -k and regex -x values. This is useful in case you have gained a limited shell on a machine and want to have “tree” with colored output to look around.
  • There’s a list variable filetype_blacklist in eviltree.py which can be used to exclude certain file extensions from content search. By default, it excludes the following: gz, zip, tar, rar, 7z, bz2, xz, deb, img, iso, vmdk, dll, ovf, ova.
  • A quite useful feature is the -i (–interesting-only) option. It instructs eviltree to list only files with matching keywords/regex content, significantly reducing the output length:

Useful keywords/regex patterns

  • Regex to look for passwords: -x ".{0,3}passw.{0,3}[=]{1}.{0,18}"
  • Keywords to look for sensitive info: -k passw,db_,admin,account,user,token
R K

Recent Posts

cp Command: Copy Files and Directories in Linux

The cp command, short for "copy," is the main Linux utility for duplicating files and directories. Whether…

7 days ago

Image OSINT

Introduction In digital investigations, images often hold more information than meets the eye. With the…

7 days ago

cat Command: Read and Combine File Contents in Linux

The cat command short for concatenate, It is a fast and versatile tool for viewing and merging…

7 days ago

Port In Networking

What is a Port? A port in networking acts like a gateway that directs data…

7 days ago

ls Command: List Directory Contents in Linux

The ls command is fundamental for anyone working with Linux. It’s used to display the files and…

1 week ago

pwd Command: Find Your Location in Linux

The pwd (Print Working Directory) command is essential for navigating the Linux filesystem. It instantly shows your…

1 week ago