Linux Command Line for Hackers

Almost every target you attack and every tool you use runs on Linux. You do not need to be a sysadmin, but you need to move through a shell without thinking about it. Practice each block in your Kali VM, then play OverTheWire’s Bandit wargame to lock it in.

Moving around

pwd                 # where am I?
ls -la              # list everything, including hidden dotfiles
cd /etc             # absolute path
cd ..               # up one level
cd ~                # home directory

Hidden files start with a dot. On a compromised box, .bash_history, .ssh/, and .config/ are some of the first places to look.

Reading files

cat file.txt               # print it all
less /var/log/syslog       # scroll; q to quit
head -n 20 file.txt        # first 20 lines
tail -f /var/log/auth.log  # follow a log live

Finding things

find / -name "*.conf" 2>/dev/null         # by name, hide permission errors
find / -perm -4000 2>/dev/null           # SUID binaries worth reviewing
grep -rni "password" /var/www 2>/dev/null  # search file contents
which python3                              # where a command lives

2>/dev/null throws away error output. You will type it constantly.

Permissions

-rwxr-x--- 1 alice devs 4096 Nov 11 app.sh
 │  │  │
 │  │  └── other: no access
 │  └───── group (devs): read + execute
 └──────── owner (alice): read + write + execute

chmod +x script.sh     # make executable
chmod 600 id_rsa       # SSH refuses keys that are readable by others
id                     # your user, groups
sudo -l                # what can I run as root?

The special SUID bit (s in place of x) makes a program run as its owner. Misconfigured SUID binaries are a common finding in lab machines and CTFs, and GTFOBins documents which ones are risky.

Pipes and redirection

The real power of the shell is chaining small tools together.

cat access.log | grep "POST" | cut -d " " -f 1 | sort | uniq -c | sort -rn | head

That one line lists the IPs that sent the most POST requests. Breaking it down:

Piece	Job
grep "POST"	keep matching lines
cut -d " " -f 1	first space-separated field
sort | uniq -c	count duplicates
sort -rn	biggest numbers first

Redirection:

command > out.txt     # overwrite
command >> out.txt    # append
command 2>&1          # send errors where stdout goes

Processes and services

ps aux                  # every process
ps aux | grep apache
ss -tulpn               # listening ports and owning processes
systemctl status ssh
kill -9 1234

ss -tulpn on a target often reveals services bound only to localhost, which are invisible to an external scan.

Networking

ip a                              # interfaces and IPs
curl -I http://192.168.56.101     # just the response headers
wget http://192.168.56.1:8000/notes.txt
nc -lvnp 4444                     # listen on a port
python3 -m http.server 8000       # serve the current directory

python3 -m http.server plus wget or curl on the target is the quickest way to move files between your lab machines.

Practice: OverTheWire Bandit

Bandit is a free wargame. Each level is a puzzle solved with exactly these commands.

ssh [email protected] -p 2220

The password for level 0 is on the Bandit website. Aim to finish levels 0 through 15. When you do, you are ready for everything else on this site.