whoami

Linux discovery T1033

Prints the current user's username. Useful for confirming privilege level after exploitation.

Binary Paths

  • /usr/bin/whoami
  • /bin/whoami

Glob Patterns

Pattern Wildcards Notes
w?oami
? Single char wildcard replaces 'h'
w*i
* Star matches 'hoam'
who[a]mi
[] Character class with single correct char
wh?ami
? Wildcard replaces 'o'
/usr/bin/w?oami
? Full path with single wildcard
/???/???/whoami
? Directory components obfuscated with ? sequences
/???/b??/w*
? * Combined ? and * across full path
w[ho]*i
[] * Character class plus star for middle
wh[o]am[i]
[] Multiple character classes, each containing correct char
/usr/*/whoami
* Wildcard in directory component

Resources

← Back to Catalog