DEV Community

Arashad Dodhiya
Arashad Dodhiya

Posted on

Linux for Cybersecurity: The Commands That Actually Matter (Reality Check)

#cybersecurity #linux #infosec #learninginpublic

When I started learning cybersecurity, Linux felt overwhelming.

People talk about “master Linux” like you need to memorize hundreds of commands before you can do anything useful. That mindset almost made me quit early.

Reality:
You don’t need all Linux commands.
You need the right ones, and you need to understand why they matter from a security point of view.

This post is a practical breakdown of the Linux commands that actually matter for cybersecurity beginners — not for flexing in terminals, but for real understanding.

Navigation & File System (You Can’t Secure What You Can’t See)

Before hacking anything, you need to know where things live.

Commands that matter 

pwd
ls
cd
tree
Enter fullscreen mode Exit fullscreen mode

Why this matters in security

  • Config files, logs, credentials — everything is just files
  • Attackers look for interesting locations, not random commands
  • You need to move fast and confidently inside unknown systems

Security mindset

If you don’t understand the Linux filesystem, you’ll never understand privilege escalation or misconfigurations.

Reading Files (Logs Are Gold)

Commands that matter 

cat
less
more
head
tail
Enter fullscreen mode Exit fullscreen mode

Why this matters

  • Logs reveal authentication attempts
  • Config files reveal secrets and bad permissions

  • You’ll constantly inspect:

    • /etc/passwd
    • /etc/shadow
    • /var/log/auth.log
    • .env files

Pro tip 

tail -f /var/log/auth.log
Enter fullscreen mode Exit fullscreen mode

This lets you watch logins in real time — very useful for learning.

File Permissions & Ownership (This Is Where Most Vulnerabilities Live)

Commands that matter 

ls -l
chmod
chown
id
whoami
Enter fullscreen mode Exit fullscreen mode

Why this matters

  • Misconfigured permissions = easy privilege escalation

  • You must understand:

    • Read (r)
    • Write (w)
    • Execute (x)

  • Who owns what — and who shouldn’t

Security example

If a sensitive script is writable by everyone:

-rwxrwxrwx
Enter fullscreen mode Exit fullscreen mode

That’s a huge vulnerability.

Searching for Interesting Files (Attackers Don’t Browse — They Search)

Commands that matter 

find
grep
locate
Enter fullscreen mode Exit fullscreen mode

Real use cases 

find / -perm -4000 2>/dev/null
Enter fullscreen mode Exit fullscreen mode

👉 Finds SUID binaries (very important for privilege escalation)

grep -R "password" /etc
Enter fullscreen mode Exit fullscreen mode

👉 Finds hardcoded secrets (common beginner mistake)

Processes & Services (What’s Running = What Can Be Attacked)

Commands that matter 

ps
top
htop
systemctl
service
Enter fullscreen mode Exit fullscreen mode

Why this matters

  • Running services expose attack surfaces
  • Misconfigured services = easy targets

  • You need to see:

    • What’s running
    • Under which user
    • With what permissions

Example 

ps aux
Enter fullscreen mode Exit fullscreen mode

Shows everything running — attackers love this.

Networking Basics (Your First Recon Tool Is Linux Itself)

Commands that matter 

ip a
ip route
ss
netstat
ping
curl
wget
Enter fullscreen mode Exit fullscreen mode

Why this matters

  • Before Nmap, understand local networking

  • Check:

    • IP addresses
    • Open ports
    • Listening services 
ss -tuln
Enter fullscreen mode Exit fullscreen mode

👉 Shows open ports without fancy tools

User & Login Information (Who Has Access?)

Commands that matter 

who
w
last
su
sudo
Enter fullscreen mode Exit fullscreen mode

Why this matters

  • See who’s logged in
  • Identify admin users
  • Detect suspicious activity 
last
Enter fullscreen mode Exit fullscreen mode

👉 Shows login history (great for blue team learning)

Package Management (Attackers Love Outdated Software)

Commands that matter 

apt
apt update
apt upgrade
dpkg
Enter fullscreen mode Exit fullscreen mode

Why this matters

  • Old packages = known vulnerabilities

  • Knowing what’s installed helps:

    • Attackers find exploits
    • Defenders patch systems

Commands You Don’t Need (At the Beginning)

You can safely ignore (for now):

  • Advanced shell scripting
  • Kernel compilation
  • Custom init systems
  • Exotic filesystem tuning

Learn depth, not breadth.

Final Reality Check

Cybersecurity Linux is not about:

  • Memorizing commands
  • Showing off terminal tricks
  • Using Kali tools blindly

It’s about:

  • Understanding systems
  • Reading configurations
  • Spotting mistakes
  • Thinking like an attacker

If you master these commands and the reasons behind them, you’ll be far ahead of most beginners.

What I’m Doing Next

  • Practicing on real labs
  • Reading logs daily
  • Breaking small systems safely
  • Learning why vulnerabilities exist

If you’re learning cybersecurity too - slow down, learn Linux properly, and don’t chase tools too early.

Top comments (0)