> For the complete documentation index, see [llms.txt](https://cybermuhdupa.gitbook.io/total-oscp-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cybermuhdupa.gitbook.io/total-oscp-guide/vulnerability-analysis/post-exploitation/cover-your-tracks.md). # Cover your tracks ### On Linux #### Log files `/etc/syslog.conf` In this file you can read all the logs that syslog log. On linux systems a lot of logs are stored in: ``` /var/logs ``` For example: ``` /var/log/messages ``` Here you have failed and successful login attempts. SSH, SUDO, and much more. ``` /var/log/auth.log ``` #### Apache ``` /var/log/apache2/access.log /var/log/apache2/error.log ``` Remove your own ip like this ``` grep -v '' /path/to/access_log > a && mv a /path/to/access_log ``` What it does is simply to copy all lines except the lines that contain your IP-address. And then move them, and them move them back again. ``` grep -v > /tmp/a ; mv /tmp/a ; rm -f /tmp/a ``` #### UTMP and WTMP These logs are not stored in plaintext but instead as binaries. Which makes it a bit harder to clear. ``` who ``` ``` last ``` ``` lastlog ``` #### Command history All your commands are also stored. ``` echo $HISTFILE echo $HISTSIZE ``` You can set your file-size like this to zero, to avoid storing commands. ``` export HISTSIZE=0 ``` If you set it when you get shell you won't have to worry about cleaning up the history. ### Shred files Shredding files lets you remove files in a more secure way. ``` shred -zu filename ``` ### On windows Clear env