Identifier / Programs / Linux and Unix
diff
Compare files and directories. tldr-pages
GTFOBins file-read 2 documented commands
How diff is abused
file-read
--line-formatfile-read
--recursiveEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for diff.
2 documented commands
file-read unprivileged, with sudo, as SUID
diff --line-format=%L /dev/null /path/to/input-filefile-read unprivileged, with sudo, as SUID
This lists the content of a directory. /path/to/empty-dir can be any directory, but for convenience it is better to use an empty directory to avoid noise output.
diff --recursive /path/to/empty-dir /path/to/input-dir/None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for diff. The identifier reads the line of each that runs diff.
Everyday use
Compare files (lists changes to turn old_file into new_file)
diff path/to/old_file path/to/new_fileIdentifyCompare files, ignoring white spaces
diff --ignore-all-space path/to/old_file path/to/new_fileIdentifyCompare files, showing the differences side by side
diff --side-by-side path/to/old_file path/to/new_fileIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.