Linux Basics

What it is: The operating system you’ll live in during 90% of security work. Fast, scriptable, and built for automation.

The fun thing: A single chained command can search an entire system for privilege escalation paths in seconds — no GUI, no clicking.

ls              # list files in current directory
ls -la          # include hidden files + permissions
cd Documents    # move into a directory
cd ..           # go up one level
cat file.txt    # print file contents
pwd             # print current directory path

Flags & switches

Commands do their default thing unless you add flags. Flags = - + a letter (or -- + a word).

ls            # default: list files (no hidden)
ls -a         # flag: show hidden files too (anything starting with .)
ls -la        # combine flags: hidden files + permissions + sizes

When you don’t know what flags exist:

ls --help     # quick list of every option with a one-line description
man ls        # full manual page — scroll with arrows, / to search, q to quit

--help = cheat sheet. man = full reference. When in doubt, check man first — it’s always there, always accurate.

Finding files — `find`

find -name passwords.txt       # find exact filename from current dir
find -name "*.txt"             # find all .txt files (wildcard)
find /etc -name "*.conf"       # search a specific directory

Security-relevant find commands

find / -perm -4000 2>/dev/null    # SUID files — run as file owner (often root)
find / -writable 2>/dev/null      # files your user can write to
find / -name "*.log" 2>/dev/null  # every log file on the system
find / -mmin -60 2>/dev/null      # files modified in the last 60 minutes

2>/dev/null silences “Permission denied” errors so output stays clean.

Why SUID matters: A SUID binary runs as its owner, not you. If it’s owned by root and can be abused → root. Finding SUID files is one of the first things you do after getting a shell.

Searching file contents — `grep`

grep "81.143.211.90" access.log          # find lines matching a value
grep -i "password" config.txt            # case-insensitive search
grep -r "api_key" ./                     # find api_key mentions in all files here

Flag reference

Flag	What it does
`-i`	Case-insensitive
`-n`	Show line numbers
`-v`	Invert — show non-matching lines
`-R` / `-r`	Recursive — search all files in directory

The pipe `|` — chain commands together

Output of one command becomes the input of the next.

cat access.log | grep "81.143.211.90" | wc -l

→ Read log → filter to one IP → count hits.

cat /etc/passwd | grep "/bin/bash"

→ Show only users with a real login shell.

Shell operators

Operator	What it does
`&`	Run in background — terminal stays usable
`&&`	Run second command only if first succeeded
`>`	Redirect to file — overwrites
`>>`	Redirect to file — appends
`\\|`	Pipe output into next command

Examples

cp bigfile.iso /backup/ &             # copy in background, keep working
mkdir logs && cd logs                 # cd only runs if mkdir succeeded
echo "hey" > welcome.txt             # creates file (overwrites)
echo "hello" >> welcome.txt          # adds line (appends)
cat access.log | grep "404"          # filter log for 404 errors

Terminal text editors

nano myfile     # open (or create) a file in nano
vim myfile      # open in vim

Nano — cheat sheet

^ means Ctrl. That’s all the shortcuts at the bottom of the screen.

Shortcut	What it does
`Ctrl + X`	Exit (prompts to save if unsaved)
`Ctrl + O`	Save (Write Out) — then `Enter` to confirm
`Ctrl + W`	Search for text
`Ctrl + K`	Cut the current line
`Ctrl + U`	Paste the cut line
`Ctrl + G`	Help
`Ctrl + C`	Show current line number / cursor position
`Ctrl + _`	Go to a specific line number
`Alt + U`	Undo
`Alt + E`	Redo

Arrow keys move the cursor. Enter = new line. That’s it — nano is intentionally simple.

Vim

More powerful but steeper curve — has its own page: Vim

Practical one-liners

Show one-liners

# How many 404 errors in the log?
cat access.log | grep "404" | wc -l

# Find all config files on the system
find / -name "*.conf" 2>/dev/null

# Search all files in current dir for the word "password"
grep -ri "password" ./

# Find recently changed files (last hour) — useful after running an exploit
find / -mmin -60 2>/dev/null | grep -v "/proc"

# List all users with a shell
cat /etc/passwd | grep "/bin/bash"

Transferring files

Download from the web — `wget`

wget https://example.com/file.txt        # download a file
wget http://10.10.10.10:8000/file.txt    # download from a specific port

Copy over SSH — `scp`

Format: scp SOURCE DESTINATION

# push a file to a remote machine
scp important.txt ubuntu@192.168.1.30:/home/ubuntu/transferred.txt

# pull a file from a remote machine
scp ubuntu@192.168.1.30:/home/ubuntu/documents.txt notes.txt

scp = cp but over SSH. Encrypted, authenticated. Replace cp whenever files cross machines.

Serve files from your machine — Python HTTP server

python3 -m http.server         # serves current directory on port 8000
python3 -m http.server 9000    # use a different port

Then on the other machine:

wget http://YOUR_IP:8000/filename

Instant file server — no setup, no config. Run it in one terminal, wget from another. Useful for moving exploit scripts onto a target after getting a shell.

Key insight

Linux efficiency = find + grep + pipe. These three tools let you search an entire system — files, contents, permissions — in seconds. In a pentest, they’re how you go from “I have a shell” to “I have root.”