> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/privesc/cron-jobs/cron-expression-calculator.md).

# Cron Expression Calculator

Cron expression calculator for common schedules, field syntax, special strings, and privilege escalation review notes.

Search a cron expression such as `* * * * *`, `*/5 * * * *`, `0 0 * * *`, or `@reboot` to read its schedule and pentest notes.

## Cron Finder

<table data-view="cards" data-full-width="true" data-search="true"><thead><tr><th>Expression</th><th>Meaning</th><th>Typical Use</th><th>Review Notes</th></tr></thead><tbody><tr><td><code>* * * * *</code></td><td>Every minute</td><td>Fast recurring task</td><td>High-value for privesc if script is writable.</td></tr><tr><td><code>*/2 * * * *</code></td><td>Every 2 minutes</td><td>Polling task</td><td>Use pspy to observe execution.</td></tr><tr><td><code>*/5 * * * *</code></td><td>Every 5 minutes</td><td>Health checks, sync jobs</td><td>Check command path and writable targets.</td></tr><tr><td><code>*/10 * * * *</code></td><td>Every 10 minutes</td><td>Maintenance job</td><td>Look for relative paths and unsafe PATH.</td></tr><tr><td><code>*/15 * * * *</code></td><td>Every 15 minutes</td><td>Scheduled sync</td><td>Check logs and script ownership.</td></tr><tr><td><code>*/30 * * * *</code></td><td>Every 30 minutes</td><td>Periodic cleanup</td><td>Review delete commands and wildcards.</td></tr><tr><td><code>0 * * * *</code></td><td>Every hour</td><td>Hourly job</td><td>Check `/etc/cron.hourly` too.</td></tr><tr><td><code>30 * * * *</code></td><td>At minute 30 every hour</td><td>Hourly offset</td><td>Monitor around the half-hour.</td></tr><tr><td><code>0 */2 * * *</code></td><td>Every 2 hours</td><td>Batch task</td><td>Check scripts in backup and sync directories.</td></tr><tr><td><code>0 0 * * *</code></td><td>Every day at midnight</td><td>Daily rotation</td><td>Check `/etc/cron.daily` and backup scripts.</td></tr><tr><td><code>30 2 * * *</code></td><td>Every day at 02:30</td><td>Nightly maintenance</td><td>Common time for root backup jobs.</td></tr><tr><td><code>0 6 * * *</code></td><td>Every day at 06:00</td><td>Morning job</td><td>Check report generation and cleanup scripts.</td></tr><tr><td><code>0 0 * * 0</code></td><td>Every Sunday at midnight</td><td>Weekly job</td><td>Check `/etc/cron.weekly`.</td></tr><tr><td><code>0 0 * * 1</code></td><td>Every Monday at midnight</td><td>Weekly job</td><td>Review business-week scripts.</td></tr><tr><td><code>0 0 1 * *</code></td><td>First day of every month</td><td>Monthly reports</td><td>Check `/etc/cron.monthly`.</td></tr><tr><td><code>0 0 1 1 *</code></td><td>Every January 1 at midnight</td><td>Yearly task</td><td>Low frequency but may run as root.</td></tr><tr><td><code>0 9-17 * * 1-5</code></td><td>Hourly from 09:00 to 17:00, Monday-Friday</td><td>Business-hours automation</td><td>Check user-owned scripts used by admin jobs.</td></tr><tr><td><code>*/15 9-17 * * 1-5</code></td><td>Every 15 minutes during business hours</td><td>Office-hour polling</td><td>Good pspy target window.</td></tr><tr><td><code>0 0,12 * * *</code></td><td>At midnight and noon</td><td>Twice daily job</td><td>Comma-separated hours.</td></tr><tr><td><code>0 3 * * 1,3,5</code></td><td>At 03:00 on Monday, Wednesday, Friday</td><td>Scheduled batch</td><td>Check day-of-week matching.</td></tr><tr><td><code>@reboot</code></td><td>At system startup</td><td>Startup script</td><td>Review persistence and writable startup commands.</td></tr><tr><td><code>@hourly</code></td><td>Once per hour</td><td>Hourly shortcut</td><td>Equivalent to `0 * * * *`.</td></tr><tr><td><code>@daily</code></td><td>Once per day</td><td>Daily shortcut</td><td>Equivalent to `0 0 * * *`.</td></tr><tr><td><code>@weekly</code></td><td>Once per week</td><td>Weekly shortcut</td><td>Equivalent to `0 0 * * 0`.</td></tr><tr><td><code>@monthly</code></td><td>Once per month</td><td>Monthly shortcut</td><td>Equivalent to `0 0 1 * *`.</td></tr><tr><td><code>@yearly</code></td><td>Once per year</td><td>Yearly shortcut</td><td>Equivalent to `0 0 1 1 *`.</td></tr></tbody></table>

## Field Calculator

```
* * * * *
| | | | |
| | | | +-- Day of week: 0-7, Sunday is 0 or 7
| | | +---- Month: 1-12
| | +------ Day of month: 1-31
| +-------- Hour: 0-23
+---------- Minute: 0-59
```

| Operator | Meaning    | Example                                 |
| -------- | ---------- | --------------------------------------- |
| `*`      | Any value  | `* * * * *` every minute                |
| `,`      | Value list | `0 0,12 * * *` midnight and noon        |
| `-`      | Range      | `0 9-17 * * *` every hour from 09 to 17 |
| `/`      | Step       | `*/5 * * * *` every 5 minutes           |

## Enumeration Commands

```bash
crontab -l
cat /etc/crontab
ls -la /etc/cron.*
find /etc/cron* -type f -exec ls -la {} \; 2>/dev/null
find /var/spool/cron -type f -exec ls -la {} \; 2>/dev/null
systemctl list-timers --all
```

## Privesc Checklist

| Check                             | Why It Matters                                  |
| --------------------------------- | ----------------------------------------------- |
| Writable script executed by root  | Direct privileged command execution path        |
| Relative command path             | PATH hijacking may control executed binary      |
| Wildcards in writable directories | Option injection against tools like `tar`       |
| World-writable cron directory     | File planting or script replacement             |
| Root job processes user files     | Parser or command injection through input files |
| Missing full paths                | Environment-dependent behavior                  |
| Logs reveal schedule              | Helps time validation and evidence collection   |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/privesc/cron-jobs/cron-expression-calculator.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.