whoami
Prints the current user's username. Useful for confirming privilege level after exploitation.
Binary Paths
/usr/bin/whoami/bin/whoami
Glob Patterns
| Pattern | Notes |
|---|---|
w?oami
|
Single char wildcard replaces 'h' |
w*i
|
Star matches 'hoam' |
who[a]mi
|
Character class with single correct char |
wh?ami
|
Wildcard replaces 'o' |
/usr/bin/w?oami
|
Full path with single wildcard |
/???/???/whoami
|
Directory components obfuscated with ? sequences |
/???/b??/w*
|
Combined ? and * across full path |
w[ho]*i
|
Character class plus star for middle |
wh[o]am[i]
|
Multiple character classes, each containing correct char |
/usr/*/whoami
|
Wildcard in directory component |
for p in /usr/{bin,sbin}/whoami; do "$p" && break; done
|
Brace expansion in for loop — generates both path alternatives and executes the first valid one |
$(ls /usr/bin/wh?ami)
|
ls resolves the glob to a full path; command substitution executes the result |
$'\x77\x68\x6f\x61\x6d\x69'
|
ANSI-C quoting with hex escapes — shell expands to the string 'whoami' before execution |
$'\167\150\157\141\155\151'
|
ANSI-C quoting with octal escapes — expands to 'whoami' |
shopt -s extglob; /usr/bin/@(who)ami
|
Extended glob — @(who) matches exactly the string 'who'; extglob must be enabled with shopt first |
Pattern Tester
$
Try typing whoami or a full path like /usr/bin/whoami
YARA Rule
Auto-generated detection rule for whoami