Identifier / Programs / Linux and Unix
od
Display file contents in octal, decimal, or hexadecimal format. Optionally display the byte offsets and/or printable representation for each line. tldr-pages
GTFOBins file-read 1 documented command
How od is abused
file-read
-An-c-w999Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for od.
1 documented command
file-read unprivileged, with sudo, as SUID
Three spaces are added before each character in the read file (wrapped at the specified value, i.e., 999), and non-printable chars are printed as backslash escape sequences.
od -An -c -w999 /path/to/input-fileThe command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for od. The identifier reads the line that runs od.
Everyday use
Display file using default settings: octal format, 8 bytes per line, byte offsets in octal, and duplicate lines replaced with *
od path/to/fileIdentifyDisplay file in verbose mode, i.e. without replacing duplicate lines with *
od --output-duplicates path/to/fileIdentifyDisplay file in hexadecimal format (2-byte units), with byte offsets in decimal format
od --format x --address-radix d --output-duplicates path/to/fileIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.
Options
Show every option of od
-AAddress base (decimal, octal, hexadecimal, none)-jSkip this many bytes of input-NStop dumping after this many bytes-tOutput type a(scii) c(har) d(ecimal) f(loat) o(ctal) u(nsigned) (he)x-vDon't collapse repeated lines together-wTotal line width in bytes (default 16)