black electronics

Terminal History

Common commands for logging and timestamping terminal history during pentests.

Keeping a timestamped, logged record of everything you type is worth the small amount of setup, both for your own notes and as evidence for a client report.

Timestamp your ZSH history

Terminal window
fc -li # List history with timestamps
fc -li 100 # List the last 100 commands with timestamps

Add the following to the end of .zshrc to show the timestamp in your right-hand prompt:

Terminal window
RPROMPT="[%D{%f/%m/%y} | %D{%H:%M:%S}]"

Log full terminal sessions to disk

Terminal window
sudo mkdir /var/log/shell
sudo chmod 777 /var/log/shell
test "$(ps -ocommand= -p $PPID | awk '{print $1}')" == 'script' || (script -f /var/log/shell/$(date +"%d-%b-%y_%H-%M-%S")_shell.log)

Session logs will contain terminal colour codes. Strip them out before sharing a log:

Terminal window
sed 's/\x1b\[[0-9;]*m//g' session.log
Useful LinksPentest PayloadsCheat Sheets