CB Linux

• low Risky intent intent-offensive-security backups.md:14
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  | Retention | How far back a mistake can be undone | Ransomware and a bad migration are both discovered days later; 7 daily copies of a corrupted file is one corrupted file |

• low Risky intent intent-offensive-security backups.md:45
  Offensive-security / dual-use content (legitimate for authorised testing; review intended use)

  - **Append-only credentials are the ransomware answer.** A host that can delete its own backups will, once compromised. restic's `--append-only` server mode, borg's `append-only` repo flag, S3 object 

• low Dangerous commands cmd-cron-mention compromise.md:30
  Mentions editing / listing crontab (documentation of a security skill)

  crontab -l; ls -la /etc/cron.*/ /var/spool/cron/    # scheduled persistence

  security skill
• low Dangerous commands cmd-persistence compromise.md:53
  Persistence mechanism (cron / launchd / scheduled task / autorun registry) (documentation table row; documentation of a security skill)

  | Cron: user crontabs, `/etc/cron.*`, `/etc/cron.d`, `at` jobs | Base64 blobs and download-then-execute one-liners; a file whose name hides among the defaults |

  tablesecurity skill
• low Dangerous commands cmd-privilege compromise.md:58
  Privilege escalation / world-writable permissions (documentation of a security skill)

  | Setuid and capabilities | New setuid binaries, `getcap -r /` results outside the baseline |

  security skill
• low Dangerous commands cmd-privilege compromise.md:61
  Privilege escalation / world-writable permissions (documentation of a security skill)

  | else | Diff against `baselines/<host>.md`: listeners, enabled units, setuid list, and the file `mtime` sweep below |

  security skill
• low Dangerous commands cmd-privilege hardening.md:54
  Privilege escalation / world-writable permissions (code comment; documentation of a security skill)

  find / -xdev -perm -4000 -type f 2>/dev/null      # setuid binaries — know every one

  commentsecurity skill
• low Dangerous commands cmd-privilege memory-template.md:117
  Privilege escalation / world-writable permissions (documentation of a security skill)

  | Audit-surface diff (setuid, world-writable, listeners) | month | 2026-07-02 | 2026-08-02 |

  security skill
• low Dangerous commands cmd-privilege memory-template.md:233
  Privilege escalation / world-writable permissions (documentation of a security skill)

  setuid binaries: 17 (list below) · world-writable: none outside /tmp · enabled units: 24

  security skill
• low Dangerous commands cmd-privilege monitoring.md:59
  Privilege escalation / world-writable permissions (documentation of a security skill)

  - Record into `baselines/<host>.md`: load and PSI ranges, `available` memory, root and data filesystem usage, `await` per device, the listening-port set, the count and list of setuid binaries, enabled

  security skill
• low Dangerous commands cmd-privilege monitoring.md:60
  Privilege escalation / world-writable permissions (documentation of a security skill)

  - The value is entirely in the diff at the next review: a new listener, a new setuid binary, a new enabled unit, or an `await` an order of magnitude off are all findings that no absolute threshold wou

  security skill
• low Dangerous commands cmd-disable-security networking.md:40
  Disables a security control (Defender, Gatekeeper, SIP, firewall, execution policy) (negated — the text forbids it)

  - Never `iptables -F` on a remote host with a DROP default policy — you flush your own access. Set policies to ACCEPT first, or schedule a rollback (→ `ssh.md`).

  negated
• low Dangerous commands cmd-pipe-to-shell packages.md:64
  Downloads and executes remote code from an unrecognised host (pipe to shell) (negated — the text forbids it)

  - Never `curl … | sh` on a host you care about: download, read, checksum, then run.

  negated
• low Dangerous commands cmd-privilege permissions.md:23
  Privilege escalation / world-writable permissions (documentation of a security skill)

  - Setuid is ignored on scripts by kernel policy (the shebang race). Only binaries honour it — use a sudoers rule or a file capability.

  security skill
• low Dangerous commands cmd-privilege permissions.md:58
  Privilege escalation / world-writable permissions (negated — the text forbids it)

  - `setcap cap_net_bind_service=+ep /usr/local/bin/app` lets an unprivileged binary bind port 80 with no setuid. `getcap -r /usr/bin 2>/dev/null` audits what already has caps.

  negated
• low Dangerous commands cmd-privilege SKILL.md:99
  Privilege escalation / world-writable permissions (negated — the text forbids it)

  1. **Never `chmod 777`.** It destroys the audit trail and usually still fails, because the denial is a different layer: ACL mask, SELinux label, mount option, or unit sandboxing. Diagnose with `namei 

  negated
• low Dangerous commands cmd-privilege SKILL.md:202
  Privilege escalation / world-writable permissions (documentation table row; documentation of a security skill)

  | `sudo echo x > /etc/file` | The redirect runs in YOUR shell before sudo starts | `echo x \| sudo tee /etc/file` |

  tablesecurity skill
• low Dangerous commands cmd-disable-security SKILL.md:209
  Disables a security control (Defender, Gatekeeper, SIP, firewall, execution policy) (documentation table row; documentation of a security skill)

  | `iptables -F` to "start clean" on a remote host | With a DROP default policy you flush your own access | Set policies to ACCEPT first, or schedule a rollback (rule 4) |

  tablesecurity skill

A further 14 matches are quotations in this security skill's documentation and are not counted as findings.