Post Exploitation: Covering Tracks

Course:  Joe Perry on "Post Exploitation Hacking" at Cybrary

Linux Tracks
~/.bash-history
cp ~/.bash-history ~/.bash-history-save
rm ~/.bash-history OR /dev/null > ~/.bash-history

Linux Timestamps​
•touch -t '1 May 2005 10:22' file

Windows Event Logs
•They’re managed on the command line by wevtutil
Wevtutil –el output
Wevtutil -cl