Lion Cipher Lab
Process text with grep, sed, and awk
- Foundations
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Almost every real security task ends with a wall of text: a log file, a config, the output of some tool. The people who move fast aren't reading it line by line — they're carving it up with three tiny commands that have been on every Unix box for 50 years. grep pulls the lines that matter, awk breaks a log into columns and does the counting, sed rewrites text on the way past. Learn this one toolkit and log triage, hunting for an attacker's IP, or tallying the top offenders stops being a chore and becomes a thirty-second reflex — and every later log-analysis lab stops assuming a skill you…
What you'll learn
- searching text with grep and basic regular expressions
- editing and transforming streams with sed substitution
- extracting and summing columns with awk
- composing Unix pipelines (sort | uniq -c | sort -rn) for top-N
- choosing the right tool: find vs edit vs compute
- knowing when regex is the wrong tool (structured data)
Steps in this lab
- The one idea: three tools, three jobs
- Build a sample log to work on (cat > with a heredoc)
- grep: find the lines that matter
- grep: context lines when one line isn't enough
- awk: pull a specific column
- awk: count and sum with arrays and END
- The pro pipeline: sort | uniq -c | sort -rn for top-N
- sed: rewrite text on the way past
- sed -i: the flag that edits the real file (and can bite)
- Judgment: why this, not that — and when NOT to reach for these
- You now own the log-triage reflex