Author: Trix Cyrus
[🔹 Follow] TrixSec GitHub
[🔹 Join] TrixSec Telegram
Linux is the backbone of modern security research. Whether you're doing penetration testing, reverse engineering, or incident response, your terminal is your primary weapon. The problem isn't finding commands, it's knowing which ones matter when you're in the field with limited time.
This reference covers 100+ Linux commands organized by function. No fluff, just what you need to know.
1. Information Gathering
Know your environment before you touch anything else.
# System information uname -a # Kernel version, architecture, hostname uname -r # Kernel release only uname -m # Machine hardware (x86_64, aarch64) uname -o # Operating system name # Hostname and identity hostname # Current hostname hostname -f # Fully qualified domain name whoami # Current username id # User ID, group IDs, and names id -u # Numeric user ID id -g # Numeric group ID id -Gn # All group names groups # Groups the current user belongs to # OS details cat /etc/os-release # OS name, version, ID lsb_release -a # LSB distribution info cat /etc/hostname # Stored hostname 2. Network Commands
Networking is where most recon starts.
# Interface configuration ifconfig # Legacy: show all interfaces ip addr # Modern: show IP addresses on all interfaces ip link # Show link layer (MAC addresses) ip route # Routing table ip neigh # ARP neighbor cache # Network statistics netstat -tulnp # TCP/UDP listeners with PIDs (legacy) ss -tulnp # Modern replacement for netstat ss -s # Socket statistics summary ss -tlnp # TCP listening sockets with processes # Connectivity tests ping -c 4 target.com # Ping with 4 packets curl -I https://target.com # HTTP headers only curl -v https://target.com # Verbose connection details wget -S https://example.com # Show server response headers # DNS resolution nslookup target.com # DNS lookup (interactive mode) dig target.com A # DNS A record query dig target.com MX # DNS MX records dig -x 8.8.8.8 # Reverse DNS lookup host target.com # Simple DNS lookup utility # Packet flow traceroute target.com # Trace packet route (requires traceroute) tracepath target.com # Alternative without sudo 3. File System Operations
Find what you need, fast.
# Search and locate find / -name "*.conf" 2>/dev/null # Find config files recursively find . -type f -mtime -7 # Files modified in last 7 days find /var/log -name "*.log" -size +50M # Large log files locate filename # Fast database search (updatedb needed) # Text search and filtering grep -r "password" /etc/ # Recursive grep, case sensitive grep -ri "admin" /var/log/ # Case insensitive recursive grep -rn "error" /app/logs/ # Include line numbers grep -rnE "(fail|error|denied)" /var/log/ # Extended regex pattern grep -rln "secret" /home/ # List only filenames grep -c "" *.txt # Count lines in files # Awk for structured text awk '{print $1}' access.log # Print first column awk -F: '{print $1, $3}' /etc/passwd # Custom field separator awk '$3 > 1000 {print $1}' /etc/passwd # Filter by numeric field df -h | awk 'NR>1 {print $5, $6}' # Disk usage with percentages free -h | awk '/Mem:/ {printf "%.1f GB free\n", $7/1024/1024/1024}' # Sed for text transformation sed 's/old/new/g' file.txt # Replace text sed -i 's/foo/bar/g' file.txt # In-place replacement sed -n '10,20p' file.txt # Print lines 10-20 sed 's/[[:space:]]*$//' file.txt # Trim trailing whitespace # View file contents cat file.txt # Full file contents less file.txt # Pager with navigation head -20 file.txt # First 20 lines tail -20 file.txt # Last 20 lines tail -f /var/log/syslog # Follow log in real time wc -l file.txt # Count lines 4. Process Management
Know what's running, kill what shouldn't be.
# Process listing ps aux # All processes (legacy) ps -ef # Full format listing ps aux | grep nginx # Filter for a service top # Interactive process viewer htop # Enhanced interactive viewer pgrep -u root nginx # PIDs by user and name pgrep -f "python script" # PIDs matching command string # Process control kill 1234 # Terminate by PID kill -9 1234 # Force kill killall nginx # Kill all processes by name pkill -u www-data # Kill all processes for a user # System load and resource usage top -p 1234 # Monitor specific PID top -d 1 # Refresh every second watch -n 1 "top -bn1" # Continuous top refresh uptime # Load averages and uptime vmstat 1 5 # 5 samples at 1 second intervals iotop # I/O usage per process lsof -p 1234 # Files opened by PID lsof -i :80 # Processes using port 80 5. File Permissions
Permissions are the first line of defense and the first thing auditors check.
# Permission inspection ls -la /etc/shadow # List with permissions ls -ld /sensitive_dir # Directory permissions only stat /file.txt # Detailed file metadata find / -perm -4000 2>/dev/null # SUID files find / -perm -2000 2>/dev/null # SGID files find / -type f -perm -o+w 2>/dev/null # World-writable files find / -type f -perm -4000 -exec ls -la {} \; # List SUID files with details # Change permissions chmod 755 script.sh # Owner rwx, group/others rx chmod 600 private.key # Owner read/write only chmod u+s /usr/bin/find # Set SUID bit chmod -R 700 sensitive_dir/ # Recursive restrictive chown user:group file.txt # Change owner and group chown -R user:group /data/ # Recursive ownership change chgrp developers file.txt # Change group only 6. Compression and Archival
Compressing evidence, packing toolkits, extracting payloads from C2.
# Tar archives tar -czf archive.tar.gz /path/to/dir # Create gzip compressed tar -xzf archive.tar.gz # Extract gzip compressed tar -czf archive.tar.gz --exclude='*.log' /dir # Exclude patterns tar -tf archive.tar.gz # List contents without extracting # Gzip compression gzip file.txt # Compress (creates .gz) gunzip file.txt.gz # Decompress gzip -9 file.txt # Maximum compression # Zip archives zip -r archive.zip /path/to/dir # Recursive zip unzip archive.zip # Extract zip unzip -l archive.zip # List contents # Other formats 7z a archive.7z /path/to/dir # 7-Zip compression 7z x archive.7z # 7-Zip extraction bzip2 file.txt # Bzip2 compression xz file.txt # XZ compression 7. SSH and Remote Access
Remote access is how you pivot.
# Connection and key management ssh user@host # Connect to remote host ssh -i key.pem user@host # Connect with specific key ssh -p 2222 user@host # Non-standard port ssh -N -L 8080:localhost:80 host # Local port forwarding ssh -N -R 9090:localhost:22 host # Remote port forwarding ssh -J jump.host user@destination.host # Jump through bastion host ssh -o StrictHostKeyChecking=no user@host # Skip host key verification ssh-copy-id user@host # Install public key # Key generation and management ssh-keygen -t ed25519 -C "researcher@lab" # Generate Ed25519 key ssh-keygen -t rsa -b 4096 -C "researcher@lab" # Generate RSA-4096 key ssh-keygen -l -f known_hosts # Show key fingerprints ssh-keyscan host >> ~/.ssh/known_hosts # Add host key manually # File transfer scp file.txt user@host:/path/ # Copy file to remote scp -r dir/ user@host:/path/ # Recursive directory copy scp -P 2222 file.txt user@host:/path/ # Non-standard port rsync -avz /local/path/ user@host:/remote/path/ # Sync with progress rsync -avz --progress /local/ ./remote/ # Local rsync with progress 8. Log Analysis
Logs tell you what happened. Learning to read them separates amateurs from professionals.
# Real-time log monitoring tail -f /var/log/auth.log # SSH authentication logs tail -F /var/log/syslog # System logs (follows renames) journalctl -f # Live systemd journal journalctl -u ssh --since "1 hour ago" # Service-specific journal # Historical log review journalctl -u nginx --since "2024-01-01" --until "2024-01-02" journalctl -p err..alert # Error level and above last # Recent logins lastb # Failed login attempts last -n 10 # Last 10 entries only # Log parsing patterns grep -i "failed\|failure" /var/log/auth.log # Authentication failures grep "Accepted\|session opened" /var/log/auth.log # Successful logins awk '{print $1,$2,$3}' /var/log/auth.log | sort -u # Unique timestamps grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn # Top attacking IPs awk '$9 == "404"' /var/log/nginx/access.log # Nginx 404s grep -E "(SELECT|UNION|INSERT|DROP)" /var/log/app.log # SQL injection attempts 9. Security Tools
The heavy hitters. These are what separation of reconnaissance from exploitation looks like.
# Network reconnaissance nmap -sV target.com # Version detection nmap -sC target.com # Default script scan nmap -A target.com # Aggressive scan (OS, versions, scripts) nmap -p- target.com # Scan all 65535 ports nmap -sS target.com # SYN stealth scan nmap -sn target.com # Ping sweep only nmap --script vuln target.com # Vulnerability scripts nmap -sU --top-ports 100 target.com # Top 100 UDP ports # Packet analysis tcpdump -i eth0 host 192.168.1.1 # Capture traffic to host tcpdump -i eth0 port 80 # HTTP traffic only tcpdump -i eth0 -w capture.pcap # Save to file tcpdump -r capture.pcap -nn # Read captured file tcpdump -i eth0 -nn 'tcp[tcpflags] & tcp-syn != 0' # SYN packets only tcpdump -i eth0 -A | grep "password" # Extract credentials from packets tcpdump -i eth0 -nn 'dst port 443' # TLS traffic # SSL/TLS analysis openssl s_client -connect target.com:443 # SSL certificate info openssl s_client -connect target.com:443 -showcerts openssl x509 -in cert.pem -text -noout # Certificate details openssl x509 -in cert.pem -dates # Certificate validity dates openssl rsa -in key.pem -check # Verify private key openssl genrsa 4096 > key.pem # Generate RSA key openssl req -new -key key.pem -out csr.pem # Generate CSR 10. Privilege Escalation Checks
Before you escalate, enumerate. Missed misconfigurations cost engagements.
# Sudo enumeration sudo -l # User's sudo privileges sudo -l -U username # Check another user's sudo rights sudo cat /etc/shadow # Common misconfiguration read # Kernel and kernel module checks uname -r # Kernel version uname -a # Full kernel info cat /proc/version # Kernel version string dpkg -l | grep linux-image # Installed kernel packages (Debian) rpm -qa kernel # Installed kernels (RHEL) lsmod # Loaded kernel modules find / -name "*exploit*" 2>/dev/null # Common exploit filenames gcc --version # Check if compiler available python --version # Python availability perl --version # Perl availability # Enumeration helpers linpeas.sh # Automated Linux enumeration linux-exploit-suggester # Kernel exploit suggestions privesc-check # PowerShell-style Linux privesc Quick Reference Summary
| Category | Must-Know Commands |
|---|---|
| Info Gathering | uname -a, hostname, whoami, id |
| Networking | ip, ss, curl, dig, nslookup |
| File Operations | find, grep, awk, sed, locate |
| Processes | ps, top, htop, kill, pgrep |
| Permissions | chmod, chown, find -perm |
| Compression | tar, gzip, zip, unzip |
| SSH | ssh, scp, rsync, ssh-keygen |
| Logs | tail -f, grep, journalctl, awk |
| Security | nmap, tcpdump, openssl |
| PrivEsc | sudo -l, uname -r, linpeas.sh |
Final Notes
This list is reference material, not a substitute for hands-on practice. Build a lab VM, run these commands against your own infrastructure, and document what each output means in context. The difference between someone who knows commands and someone who understands systems is the ability to interpret anomalous output under pressure.
Keep this bookmarked. You will need it.
~TrixSec
