The Linux Command Line

Navigate the filesystem, manage files, understand permissions, and chain commands with pipes.

Easy 40m 3 tasks

Prerequisites: How Computers Work

Learning Objectives

→ Navigate the Linux directory hierarchy (cd, ls, pwd, find)
→ Read and modify file permissions with chmod and chown
→ Search file contents with grep and find
→ Chain commands with pipes and redirects

Linux runs 99% of the world's servers and nearly every security tool. If you're doing any offensive or defensive security work, the terminal is your home. This lesson gets you comfortable with the basics.

Why the Terminal?

Speed — faster than a GUI once you know the commands
Automation — string commands together, write scripts
Remote access — SSH into servers with no GUI
Tools — Nmap, Metasploit, Wireshark CLI, everything runs here

The Shell

When you open a terminal, you're running a shell — a program that reads your commands and executes them. The most common shell is bash (Bourne Again Shell).

omayma@kali:~$
  │       │  │
  │       │  └── $ = normal user (# = root)
  │       └───── current directory (~ = home)
  └───────────── username@hostname

Navigation

pwd                    # print working directory
ls                     # list files
ls -la                 # list all files with details (including hidden)
cd /etc                # change to /etc directory
cd ..                  # go up one level
cd ~                   # go to home directory
cd -                   # go to previous directory

The Linux Filesystem

/                      root of everything
├── bin/               essential binaries (ls, cat, bash)
├── etc/               configuration files ← important for recon
├── home/              user home directories
├── root/              root user's home
├── var/               variable data (logs, databases)
│   └── log/           system logs ← check here for evidence
├── tmp/               temporary files (world-writable!)
├── proc/              virtual filesystem for process info
└── usr/               user programs and utilities

Security note: /etc/passwd lists users, /etc/shadow stores password hashes, /tmp is world-writable (common malware staging area).

Working with Files

cat /etc/passwd        # print file contents
less /var/log/auth.log # page through a large file
head -20 file.txt      # show first 20 lines
tail -f /var/log/syslog # follow log in real time
cp source dest         # copy file
mv source dest         # move/rename file
rm file.txt            # delete file
mkdir newdir           # create directory
touch file.txt         # create empty file

Finding Things

find / -name "*.txt" 2>/dev/null        # find all .txt files
find / -perm -u=s -type f 2>/dev/null  # find SUID binaries
find /home -name "*.ssh" -type d        # find SSH directories
locate shadow                           # fast search by name
which nmap                              # find location of a program

Searching Inside Files

grep "password" /etc/config.php         # search for "password"
grep -r "secret" /var/www/html/         # search recursively
grep -i "error" /var/log/apache2/*.log  # case-insensitive
grep -n "root" /etc/passwd              # show line numbers

Users and Permissions

whoami                 # current user
id                     # user ID and group memberships
sudo command           # run command as root
su - alice             # switch to user alice
passwd                 # change your password

chmod 755 script.sh    # change permissions (rwxr-xr-x)
chown alice:devs file  # change owner and group

Permission numbers:

4 = read (r)
2 = write (w)
1 = execute (x)

755 = rwxr-xr-x  (owner: all, group: r+x, others: r+x)
644 = rw-r--r--  (owner: r+w, group: r, others: r)
600 = rw-------  (owner: r+w only)
777 = rwxrwxrwx  (everyone can do everything — dangerous!)

Processes & Network

ps aux                 # list all running processes
ps aux | grep nginx    # find nginx process
kill -9 1234           # force-kill process with PID 1234
top / htop             # live process monitor

netstat -tulpn         # show listening ports
ss -tulpn              # modern replacement for netstat

Pipes and Redirection

The power of the terminal: chain commands together.

command > file.txt     # redirect output to file (overwrites)
command >> file.txt    # append output to file
command 2>/dev/null    # discard error messages
command1 | command2    # pipe output of cmd1 to input of cmd2

Examples:

cat /etc/passwd | grep bash    # find users with bash shell
ps aux | grep -v root          # list processes not owned by root
find / -name "*.log" 2>/dev/null | xargs grep "password"

Useful Shortcuts

Shortcut	Action
`Ctrl+C`	Kill running command
`Ctrl+Z`	Suspend command
`Ctrl+L`	Clear screen
`Tab`	Autocomplete
`↑/↓`	History navigation
`!!`	Repeat last command
`!$`	Last argument of previous command

Key Takeaways

The filesystem hierarchy matters — know where configs, logs, and binaries live
find + grep are your best friends for reconnaissance
Understand permissions: read/write/execute for owner/group/others
Pipes (|) let you chain commands into powerful one-liners

Linux uses a single tree rooted at / (root). There are no drive letters — everything is a file or directory hanging off the root.

Directory	Contents	Security relevance
/etc	System config files	/etc/passwd, /etc/shadow, /etc/sudoers — prime targets
/var	Variable data (logs, spool)	Log files in /var/log — your forensic evidence
/tmp	Temp files (world-writable)	Attackers write malware here; race condition vulns
/home	User home dirs	SSH keys, shell history, credentials files
/bin, /usr/bin	System binaries	SUID binaries here are common privesc vectors
/proc	Virtual kernel info	/proc//maps shows process memory
/dev	Device files	/dev/null (discard), /dev/tty (terminal)

# Essential navigation pwd # where am I? ls -la /etc # list with hidden files + permissions cd /var/log # change directory find / -name '*.conf' 2>/dev/null # find all .conf files tree /etc -L 2 # visual tree (install: apt install tree)

✦ Answer the questions to complete this task

Which directory contains system configuration files like /etc/passwd?

Why is /tmp dangerous from a security perspective?

Linux permissions control exactly who can read, write, or execute each file. Every file has an owner (user), a group, and permissions for others.

chmod 754 — rwxr-xr--

Reading ls -l output

-rwxr-xr-- 1 alice devs 4096 Jun 19 secret.sh │││││││││ ││││││├── other: r-- (4) │││││├─── group: r-x (5) ││├────── owner: rwx (7) │└─────── file type: - (regular), d (dir), l (symlink)

Command	Effect
chmod 755 file	Owner: rwx Group: r-x Other: r-x
chmod 600 file	Owner: rw- Group: --- Other: --- (private key)
chmod +x script.sh	Add execute bit for all
chown alice:devs file	Set owner to alice, group to devs
chmod o-w file	Remove write from 'others'

⚠ Security: SSH private keys (~/.ssh/id_rsa) must be chmod 600. If they're world-readable, SSH refuses to use them — and attackers can steal them.

✦ Answer the questions to complete this task

What chmod value gives owner full access, group read+execute, others nothing?

Why should ~/.ssh/id_rsa be chmod 600?

grep searches text, find searches the filesystem. Connect them with pipes to build powerful one-liners.

Unix Pipeline — data flows left to right

grep — search inside files

grep 'Failed password' /var/log/auth.log # find failed SSH logins grep -r 'password' /etc/ 2>/dev/null # recursive search grep -i 'error' app.log | tail -20 # case-insensitive, last 20 grep -v '^#' /etc/ssh/sshd_config # exclude comment lines grep -E '([0-9]{1,3}\.){3}[0-9]{1,3}' file # regex: find IP addresses

find — search by file attributes

find / -perm -4000 2>/dev/null # SUID files (privesc! find /home -name '*.key' 2>/dev/null # SSH/TLS key files find /tmp -newer /tmp/baseline # files newer than baseline find / -user root -writable 2>/dev/null # writable by current user

⚠ Security: find / -perm -4000 lists all SUID binaries. If an attacker can run a SUID binary owned by root, they can often escalate privileges.

✦ Answer the questions to complete this task

What does grep -r do?

Which find option searches for SUID binaries?