User Information (Linux)

Users actions

who -a `current logged user`
w <user> `info of actual logged users`
whoami
id
last `last logged user`

All User UID and GID Info

for user in $(cat /etc/passwd |cut -f1 -d":"); do id $user; done

All UID 0 Accounts (root)

cat /etc/passwd |cut -f1,3,4 -d":" |grep "0:0" |cut -f1 -d":" |awk '{print $1}'

Find Files with “history” In Their Name (.bash_history, etc.)

find /* -name *.*history* -print 2> /dev/null

Find Files Owned By A Particular User

find / -user <www-data>

Find Files Owned By A Particular Group

find / -group <sudo>

Find File Types Owned by a Particular User

find / -user <admin> -name “*.sh”