DEV Community: Shubham Chaudhary

Linux chown Cheat Sheet: Fix Permission Denied Without Breaking Servers

Shubham Chaudhary — Tue, 29 Sep 2026 19:04:00 +0000

Your container starts, but the app can't write to the mounted volume. The log says permission denied, and a forum answer says to run a recursive chown as root.

Before you paste it, here is what to know.

The commands you'll use most

chown user file.txt          # change owner
chown user:group file.txt    # change owner and group
chown :group file.txt        # change group only
chown -R user:group folder/  # recursive change
ls -ln file.txt              # verify numeric UID/GID

Why containers make this tricky

A user name on your host may map to a different number inside a container or on a restored backup. When volumes misbehave, check the numeric IDs with ls -ln and use chown 1000:1000 file.txt when the numbers matter more than the names.

Where it goes wrong

chown -R with sudo on the wrong path can break SSH logins, cron jobs, and services.
chown user: file.txt does not keep the existing group. It switches to that user's login group.
Owning an entire web app tree with the web server user lets a compromise rewrite the app's own code.

A safer habit: preview with find, change narrowly, use -c or -v for a record, and verify afterward.

The security angle

Ownership is an access control. Files that root runs or trusts shouldn't belong to low-privileged accounts, and Linux auditd can log ownership changes so a SOC team can review them.

The full guide covers 40+ examples, find-based bulk changes, symlink pitfalls, and auditd rules:

https://www.xpert4cyber.com/2026/09/linux-chown-command-cheat-sheet.html

What is the trickiest permissions bug you have debugged? Share it below.

Linux File Permissions Explained: chmod 644, 755, 600 and Safer Fixes

Shubham Chaudhary — Mon, 28 Sep 2026 19:52:41 +0000

Your deploy script fails with "permission denied." You run chmod 777, the error disappears, and you move on. 🚀

That shortcut leaves the file writable by every local user. If a cron job, CI runner, or service executes it with higher privileges, you have created a possible privilege escalation path. ⚠️

The model behind chmod is small enough to memorize:

🔹 Read = 4, Write = 2, Execute = 1
🔹 Add them per class: owner, group, others
🔹 So 644 = rw-r--r--

Safer defaults

644 for regular files
755 for scripts and directories
600 for SSH private keys and secrets 🔑
640 for configs a service group must read
700 for private directories like ~/.ssh

Avoid blanket recursive chmod

chmod -R 755 makes every file executable. Set directories and files separately instead:

find project/ -type d -exec chmod 755 {} +
find project/ -type f -exec chmod 644 {} +

Audit for risky permissions (read-only)

find / -xdev -type f -perm -0002 2>/dev/null
find / -xdev -type f -perm -4000 2>/dev/null

The first lists world-writable files. The second lists setuid files, which should only be familiar system binaries. 🛡️

The full guide also covers SSH key rules, setgid, the sticky bit, and auditd logging of permission changes.

👉 Full Linux chmod cheat sheet: https://www.xpert4cyber.com/2026/09/linux-chmod-cheat-sheet-file-permissions.html

What is the worst permission mistake you have found in a repo or server? Share it below. 💬

OnePlus 15 Root Exploit: When Zero Permissions Still Means Full Root

Shubham Chaudhary — Sun, 27 Sep 2026 19:23:09 +0000

Most mobile risk models assume: no permissions requested = low risk. A newly disclosed OxygenOS vulnerability breaks that assumption completely.

Security researcher Rasmus Moorats found two chained flaws in OnePlus 15 devices that let a completely permissionless Android app execute code with full root privileges — no camera, storage, or SMS access needed. He reproduced it on a fully stock, unmodified device on the first attempt.

The exploit chain

AtlasService — a OnePlus debugging service that runs as root but never verifies the calling app's identity. A crafted request gets passed unsanitized into a system command.
olc2 — a hardware interface whose only guard is checking that the caller already has root, which stage one just handed over via doShell.

Chained together, these two "debugging oversights" become a full sandbox escape with no Android permissions ever requested.

Why this matters for security tooling

Permission-based heuristics are the backbone of most mobile threat defense (MTD) and MDM policies. This proof-of-concept app would sail past every one of them, because static analysis flags requested permissions — not privileged system services with broken caller verification.

Current status

✅ Fix confirmed: OxygenOS 16.0.10.500(EX01)
⚠️ OnePlus confirms broader OPPO device ecosystem affected
❌ No CVE assigned yet
❌ No full affected-device list published

Full breakdown — exploit mechanics, disclosure timeline, SOC detection strategies, and ADB commands for fleet-wide patch verification — in the original post 👇

OnePlus 15 Root Exploit: Zero-Permission Apps Can Take Full Control

OnePlus 15 root exploit lets zero-permission apps gain full control via OxygenOS flaws. Update now — here's what's affected and how to stay safe.

xpert4cyber.com

One Misconfigured chmod Command Gave Attackers Root Access

Shubham Chaudhary — Sun, 27 Sep 2026 17:35:25 +0000

TITLE: One Misconfigured chmod Command Gave Attackers Root Access

TL;DR: chmod 777 as a "fix" for permission errors still causes real 2026 CVEs. Here's the mechanics, and the commands to audit this properly.

If you've hit "Permission denied" and reflexively run chmod 777 — you're not alone, and it's how CVE-2026-29126 happened in March 2026. A root-owned script on embedded hardware got left world-writable. No exploit dev, no memory corruption. Any local user could edit it, and it ran as root on the next automated trigger. CVSS 8.5. A near-identical bug (CVE-2026-24063) hit a different vendor's macOS uninstaller weeks later.

Both are textbook CWE-276 / CWE-732: incorrect permission assignment, entirely preventable with commands we all learned in week one and stopped thinking about.

ls -l file # current permissions
stat file # exact octal mode + timestamps
chmod 750 file # correct, not 777
chown user:group file # fix ownership
umask 027 # safe defaults

Also in the full writeup:

The permission model (owner/group/other, octal vs symbolic), used the way an audit uses it
How both 2026 CVEs worked, step by step
Detection via MITRE's DET0351 strategy — auditd + SIEM correlation
Hardening beyond "don't use 777": ACLs, systemd umask, checking installer output

Full post: https://www.xpert4cyber.com/2026/09/linux-file-permissions-chmod-chown-root-access.html

sed for SOC Analysts: The Log Triage Skill Most Tutorials Skip

Shubham Chaudhary — Sat, 26 Sep 2026 16:39:43 +0000

Most write-ups on sed stop at 's/find/replace/g' and call it a day. That barely scratches what it's actually useful for in production and security work.

I write a lot of Linux tutorials for a SOC-analyst audience, and sed keeps coming up as one of those commands people half-know — enough to fumble through a quick find-replace, but not enough to use it as an actual triage tool during an incident.

A few practical uses that go beyond the basics:

Filtering log streams in real time by piping tail -f through sed
Pattern-matching for SQL injection attempts or brute-force login noise in access/auth logs
Redacting IPs and sensitive fields with regex before logs get shared or archived
Normalizing timestamp formats across inconsistent log sources before ingest
The GNU vs BSD sed difference that breaks scripts the moment you move from Linux to macOS

Full syntax reference plus a walkthrough built around a real brute-force + SQL injection triage scenario: https://www.xpert4cyber.com/2026/09/sed-command-soc-analysts-log-triage.html

If you're scripting log automation or building incident response tooling, this is one of those unglamorous skills that pays off constantly.

Stop Debugging Ghost Bugs in Your Log Files — Use tr

Shubham Chaudhary — Fri, 25 Sep 2026 17:55:29 +0000

Stop Debugging Ghost Bugs in Your Log Files — Use tr

You cat a log file. Looks fine. You grep for an IP. Nothing matches. You're not losing your mind — the file's shape is broken, not its content.

Common culprits:

Hidden \r from a Windows export
Inconsistent case (Example.com vs example.com)
Double/triple spaces wrecking awk field splits

tr (translate) is the most underrated tool in the grep/awk/sed trio — pure character-level ops, zero regex overhead, near-zero learning curve.

Quick wins:

# Fix Windows -> Unix line endings (do this first, always)
tr -d '\r' < windows.txt > linux.txt

# Normalize case before dedup
tr 'A-Z' 'a-z' < hosts.txt

# Collapse messy whitespace so awk actually works
tr -s ' ' < export.txt

# Whitelist-only digits (great for extracting ports/IDs)
tr -cd '0-9\n' < file.txt

Rule of thumb: never redirect tr output back onto the same file you're reading — it truncates before reading. Always write to a new file, especially when working from log/evidence copies.

Full breakdown with POSIX character classes, -cd whitelisting, and where this fits in a SOC/log-pipeline workflow:

👉 https://www.xpert4cyber.com/2026/09/linux-tr-command-tutorial-soc-log-cleanup.html

The Linux Command That's Quietly Saving (or Costing) SOC Teams Their Evidence

Shubham Chaudhary — Thu, 24 Sep 2026 16:30:44 +0000

Three hours into a lateral-movement investigation, the process list on a compromised jump host shows something that shouldn't be there — and it's about to scroll off screen. There's no time to re-run the command later and hope the host still looks the same. If that output isn't captured right now, exactly as it appears, it's gone.

This is a gap a lot of incident response workflows quietly have: analysts see critical output live, react to it, and never actually preserve it. By the time someone writes the report, the "evidence" is a half-remembered terminal session.

There's a decades-old Unix command built for exactly this problem, and most people only use half its power.

tee reads from stdin and writes that same stream to stdout and to a file simultaneously — not sequentially, not as a fallback, both at once. That's a meaningfully different tool than command > file, which hides output from the screen entirely. During active triage, you need both: live visibility to make fast decisions, and a durable, unaltered copy to back up why you made them.

In the full writeup, I cover:

The core mechanics of tee and why it beats plain redirection for evidence capture
A real SOC scenario building a running incident case log with tee -a
The full command reference — multi-file writes, sudo writes to protected paths, filtering with grep/wc/sort without losing raw output, capturing stderr
The adversarial side: what unusual tee invocations look like in EDR telemetry
Practical tips on hashing captured logs so they hold up as real evidence

If your IR process still relies on analysts manually copy-pasting terminal output after the fact, this closes a real gap.

Full guide: https://www.xpert4cyber.com/2026/09/linux-tee-command-soc-incident-response.html

The Linux wc Command Every Dev Should Actually Know (Beyond Counting Lines)

Shubham Chaudhary — Wed, 23 Sep 2026 18:53:58 +0000

Title: The Linux wc Command Every Dev Should Actually Know (Beyond Counting Lines)
Tags: linux, cybersecurity, commandline, devops
Filename: linux-wc-command-tutorial-soc-log-analysis-devto.jpg

Most developers meet wc once — usually counting lines in a file — and never touch it again. That's a missed opportunity, especially if you ever debug logs or work near security operations.

wc (word count) reports lines, words, bytes, and characters for any input, file or piped. On its own that sounds trivial. Piped after grep, it becomes a fast way to quantify anything in a log:

grep "Failed password" /var/log/auth.log | wc -l

That one line turns a pattern match into a hard number — useful for spotting a brute-force login spike, counting error entries, or sanity-checking log volume before reaching for heavier tooling.

Practical patterns worth memorizing:

wc -l file.txt # line count
wc -w file.txt # word count
wc -c file.txt # byte count
wc -m file.txt # character count
wc -l /var/log/*.log # count across rotated logs
find . -type f | wc -l # count files in a directory
wc -l < file.txt # number only, no filename

One gotcha: echo appends a trailing newline, which wc -c counts as an extra byte. Use echo -n when byte-accuracy actually matters.

Full breakdown covering every flag, multi-file usage, piping patterns, and a real SOC brute-force detection scenario using wc -l:

https://www.xpert4cyber.com/2026/09/linux-wc-command-tutorial-soc-log-analysis.html

cmp vs diff on Linux: The Byte-Level Comparison Tool Devs Overlook

Shubham Chaudhary — Tue, 22 Sep 2026 18:56:37 +0000

Most developers know diff. Fewer know its quieter sibling: cmp — and that gap shows up the moment you need to compare something diff wasn't built for.

diff is a text-diffing tool. Feed it a compiled binary, a disk image, or a compressed archive, and you either get garbage output or a flat "binary files differ" with zero useful detail. cmp doesn't have that problem — it treats every file as a raw byte stream and tells you the exact byte (and line, for text) where two files first diverge. That makes it the right tool for validating builds, checking backups, verifying downloads, and catching unexpected changes in config files or executables.

I wrote up a full breakdown of cmp aimed at engineers and SOC-adjacent devs who want a fast, dependency-free integrity check without reaching for a full monitoring stack:

cmp vs diff — the actual technical distinction and when each applies
A real-world scenario: catching a tampered config file with a single command
Every practical flag explained (-s for scripting, -n for byte-range limits, -i for offset skipping) with concrete use cases
How to wire cmp -s into shell scripts, cron jobs, and CI pipelines using exit-status logic
Where cmp fits (and where it doesn't) next to enterprise file integrity monitoring and compliance frameworks like PCI DSS and HIPAA

If you've ever needed to confirm two binaries, ISOs, or config files are byte-for-byte identical without pulling in extra tooling, this one's worth a read.

Full guide: https://www.xpert4cyber.com/2026/09/linux-cmp-command-guide.html

Linux diff Isn't Just for Code: Catch Config Drift Before It Bites

Shubham Chaudhary — Mon, 21 Sep 2026 19:27:36 +0000

You already use git diff every day. Point the same idea at a config file and it becomes a security tool.

Config drift is one of the quietest problems on Linux servers. Changing PermitRootLogin from no to yes in sshd_config breaks no build and fails no review. It just sits there.

Plain diff, checked against a protected baseline, catches it in seconds. My full guide covers:

diff -u for readable unified output (Git uses the same style)
diff -rq dir1 dir2 to list changed files across a whole tree
Exit codes 0, 1, and 2 for reliable script checks
Ignore flags (-i, -w, -B) for triage, and why to re-run without them
A read-only Bash check that logs drift to syslog for your SIEM

Bonus: process substitution compares command output with no temp files:

diff baseline.txt <(cut -d: -f1 /etc/passwd | sort)

Educational, defensive-security content for SOC analysts, sysadmins, and developers.

Full tutorial: https://www.xpert4cyber.com/2026/09/linux-diff-command-tutorial.html

How do you track config drift today: diff, hashes, Git, or an FIM tool?

Linux uniq Command: Why Duplicates Survive (and the Fix)

Shubham Chaudhary — Sun, 20 Sep 2026 19:01:24 +0000

The bug: you run uniq on a file and the duplicates are still there.

printf 'alice\nalice\nbob\nalice\n' | uniq
# alice
# bob
# alice

uniq only compares each line with the one directly before it, so scattered duplicates slip through. Sort first and the picture changes:

printf 'alice\nalice\nbob\nalice\n' | sort | uniq -c | sort -nr
#       3 alice
#       1 bob

That pattern is a fast triage tool for logs. On a web server access log, it ranks client IPs (the first field in common Apache/Nginx formats):

awk '{print $1}' access.log | sort | uniq -c | sort -nr | head -10

One address dominating the list is worth a closer look, but CDNs and corporate proxies can also produce high counts, so treat it as a lead, not proof.

The full guide covers -d, -u, -i, -f, -s, and -w, plus SSH brute-force ranking, an /etc/passwd UID 0 audit, rare-event hunting, and how to save output without overwriting your source file:
https://www.xpert4cyber.com/2026/09/linux-uniq-command-log-analysis.html

What's your go-to one-liner for log triage?

Brevo Supply Chain Attack: A Stolen Cloudflare API Key Exposed 100,000+ Sites

Shubham Chaudhary — Sat, 19 Sep 2026 20:31:50 +0000

🚨 Brevo Supply Chain Attack: A Stolen Cloudflare API Key Exposed 100,000+ Sites

TL;DR: On Sept 14, 2026, a hardcoded Cloudflare API key let attackers deploy a malicious Worker on Brevo's infrastructure — injecting ClickFix malware and a hidden WordPress backdoor into 100,000+ sites, without ever touching origin files.

🔍 How it worked:

A long-lived Cloudflare API key with full account permissions was stored in Brevo's application source code. Once stolen, it let attackers create Workers, routes, and DNS records without triggering alerts.

The Worker sat between visitors and Brevo's origin server, rewriting responses in transit. Origin files stayed untouched — which is exactly why standard file-integrity checks saw nothing wrong.

⚔️ Two attack paths:

1️⃣ ClickFix malware — regular visitors saw a fake Cloudflare "Verify You're Human" page instructing them to press Win+R → Ctrl+V → Enter. The clipboard already held a malicious command.

2️⃣ WordPress backdoor — logged-in admins had a disguised plugin ("Web Media Optimizer") silently installed via their own session. It hides from the plugin list, drops into mu-plugins, and contains a hardcoded key for passwordless admin access. MFA at login wouldn't have stopped this — it rides an already-authenticated session.

🛡️ Quick defensive win for WordPress devs:

define('DISALLOW_FILE_MODS', true);

This single wp-config.php setting disables dashboard plugin/theme installs — blocking the exact silent-install path used here.

📋 What I cover in the full writeup:

Confirmed timeline (per Brevo's post-mortem)
Real IOCs for log hunting
Nginx/WP-CLI/PowerShell detection commands
Microsoft Defender KQL hunting query
Full WordPress prevention checklist

If you maintain any WordPress site embedding Brevo widgets, this is a 10-minute read worth your time 👇

🔗 https://www.xpert4cyber.com/2026/09/brevo-clickfix-malware-wordpress-backdoor-attack.html