CmdID / Programs / Linux and Unix

uniq

Output the unique lines from an input or file. Since it does not detect repeated lines unless they are adjacent, we need to sort them first. tldr-pages

GTFOBins file-read 1 documented command

How uniq is abused

documented by GTFOBins

file-read

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for uniq.

1 documented command

from GTFOBins, each read by CmdID

file-read unprivileged, with sudo, as SUID

The read file content is corrupted by squashing multiple adjacent lines.

uniq /path/to/input-file

Identify

The command CmdID reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for uniq. CmdID reads the line that runs uniq.

Everyday use

from tldr-pages, CC BY 4.0

Display each line once

sort path/to/file | uniqIdentify

Display only unique lines

sort path/to/file | uniq --uniqueIdentify

Display only duplicate lines

sort path/to/file | uniq --repeatedIdentify

None of the 3 examples CmdID reads matches GTFOBins abuse or trips a Sigma process-creation rule.

Options

8 in toybox

Show every option of uniq

-cShow counts before each line

-dShow only lines that are repeated

-uShow only lines that are unique

-iIgnore case when comparing lines

-zLines end with \0 not \n

-w MAXCHARSCompare maximum X chars per line

-f FIELDSIgnore first X fields

-s CHARIgnore first X chars

uniq

How uniq is abused

1 documented command

Everyday use

Options

Other programs abused for file-read