Unit 2: Reading and checking files · Lesson 4 of 6 · 20 min
Proving a file changed
Fingerprint the web root with sha256sum and catch an edit the timestamps hide.
mission
- You are
- You are checking the website files for tampering.
- Situation
- On 30 September the previous admin saved SHA-256 fingerprints of every web file. Every file still shows the same date, 14 October 09:00.
- Goal
- Recompute the fingerprints and compare them with the baseline.
- Hand in
- The name of any changed file and what was added to it.
See what a fingerprint is
Change one character and the whole hash changes. That is what makes hashes useful for integrity checks.
sha256sum /var/www/html/robots.txt 16ceb5ee3e0dc13aa9adf31a3ebbe45a1d965b8c2b9f72eaf84e5911e140ed95 /var/www/html/robots.txt echo 'User-agent: *' | sha256sum fd89345af6aca5dab85f2aa6a830e270a362b1fa6b5f19607ddd773a081ed651 - echo 'User-agent: *!' | sha256sum 3c0d43cf866ec571650b325d40aa6653a82d385f6a1fcb51ca3b25d029ad3264 -
you should see One extra character, a completely different fingerprint.
Read the baseline
head -n 3 /srv/baseline/www.sha256
72b9a24f1866c3393ce5debbf0c50ac3aa8c565df5eeb15309247021962fef40 ./.git/config
f6ad1a2746fd701484b5100c8254716d015febe335f780a996715342f4897618 ./assets/css/site.css
07e9e867f8ac3af35001da64b63f4b405e3281b52e8cb3956de56d59a6f329b7 ./assets/js/app.js
you should see Hash, two spaces, relative path. The paths start with ./, so the check must run from the web root.
Check every file against it
cd /var/www/html sha256sum -c /srv/baseline/www.sha256 ./.git/config: OK ./assets/css/site.css: OK ./assets/js/app.js: OK ./index.html: FAILED ./robots.txt: OK sha256sum: WARNING: 1 computed checksum did NOT match
you should see One file no longer matches. --quiet would print only the failures.
defender tip Store baselines somewhere the web server account cannot write, or an intruder simply updates them.
Find what changed
ls -l --time-style=long-iso index.html robots.txt -rw-r--r-- 1 www-data www-data 238 2026-10-14 09:00 index.html -rw-r--r-- 1 www-data www-data 23 2026-10-14 09:00 robots.txt grep -o 'src="[^"]*"' index.html src="https://cdn.example-metrics.net/m.js"
you should see Same date on both files, yet one gained a script from an outside domain. Dates can be set to anything, hashes cannot be faked.
Two ways to look for changes
index.html 2026-10-14 09:00 robots.txt 2026-10-14 09:00
Identical, proves nothing
./index.html: FAILED ./robots.txt: OK
Content changed
What a defender takes away
- 1sha256sum turns content into a fingerprint.
- 2sha256sum -c compares a whole folder with a baseline.
- 3Never trust timestamps alone.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.