Author: Trix Cyrus
[🔹 Follow] TrixSec GitHub
[🔹 Join] TrixSec Telegram
Linux is the backbone of modern security research. Whether you're doing penetration testing, reverse engineering, or incident response, your terminal is your primary weapon. The problem isn't finding commands, it's knowing which ones matter when you're in the field with limited time.
This reference covers 100+ Linux commands organized by function. No fluff, just what you need to know.
1. Information Gathering
Know your environment before you touch anything else.
# System information
uname -a # Kernel version, architecture, hostname
uname -r # Kernel release only
uname -m # Machine hardware (x86_64, aarch64)
uname -o # Operating system name
# Hostname and identity
hostname # Current hostname
hostname -f # Fully qualified domain name
whoami # Current username
id # User ID, group IDs, and names
id -u # Numeric user ID
id -g # Numeric group ID
id -Gn # All group names
groups # Groups the current user belongs to
# OS details
cat /etc/os-release # OS name, version, ID
lsb_release -a # LSB distribution info
cat /etc/hostname # Stored hostname
2. Network Commands
Networking is where most recon starts.
# Interface configuration
ifconfig # Legacy: show all interfaces
ip addr # Modern: show IP addresses on all interfaces
ip link # Show link layer (MAC addresses)
ip route # Routing table
ip neigh # ARP neighbor cache
# Network statistics
netstat -tulnp # TCP/UDP listeners with PIDs (legacy)
ss -tulnp # Modern replacement for netstat
ss -s # Socket statistics summary
ss -tlnp # TCP listening sockets with processes
# Connectivity tests
ping -c 4 target.com # Ping with 4 packets
curl -I https://target.com # HTTP headers only
curl -v https://target.com # Verbose connection details
wget -S https://example.com # Show server response headers
# DNS resolution
nslookup target.com # DNS lookup (interactive mode)
dig target.com A # DNS A record query
dig target.com MX # DNS MX records
dig -x 8.8.8.8 # Reverse DNS lookup
host target.com # Simple DNS lookup utility
# Packet flow
traceroute target.com # Trace packet route (requires traceroute)
tracepath target.com # Alternative without sudo
3. File System Operations
Find what you need, fast.
# Search and locate
find / -name "*.conf" 2>/dev/null # Find config files recursively
find . -type f -mtime -7 # Files modified in last 7 days
find /var/log -name "*.log" -size +50M # Large log files
locate filename # Fast database search (updatedb needed)
# Text search and filtering
grep -r "password" /etc/ # Recursive grep, case sensitive
grep -ri "admin" /var/log/ # Case insensitive recursive
grep -rn "error" /app/logs/ # Include line numbers
grep -rnE "(fail|error|denied)" /var/log/ # Extended regex pattern
grep -rln "secret" /home/ # List only filenames
grep -c "" *.txt # Count lines in files
# Awk for structured text
awk '{print $1}' access.log # Print first column
awk -F: '{print $1, $3}' /etc/passwd # Custom field separator
awk '$3 > 1000 {print $1}' /etc/passwd # Filter by numeric field
df -h | awk 'NR>1 {print $5, $6}' # Disk usage with percentages
free -h | awk '/Mem:/ {printf "%.1f GB free\n", $7/1024/1024/1024}'
# Sed for text transformation
sed 's/old/new/g' file.txt # Replace text
sed -i 's/foo/bar/g' file.txt # In-place replacement
sed -n '10,20p' file.txt # Print lines 10-20
sed 's/[[:space:]]*$//' file.txt # Trim trailing whitespace
# View file contents
cat file.txt # Full file contents
less file.txt # Pager with navigation
head -20 file.txt # First 20 lines
tail -20 file.txt # Last 20 lines
tail -f /var/log/syslog # Follow log in real time
wc -l file.txt # Count lines
4. Process Management
Know what's running, kill what shouldn't be.
# Process listing
ps aux # All processes (legacy)
ps -ef # Full format listing
ps aux | grep nginx # Filter for a service
top # Interactive process viewer
htop # Enhanced interactive viewer
pgrep -u root nginx # PIDs by user and name
pgrep -f "python script" # PIDs matching command string
# Process control
kill 1234 # Terminate by PID
kill -9 1234 # Force kill
killall nginx # Kill all processes by name
pkill -u www-data # Kill all processes for a user
# System load and resource usage
top -p 1234 # Monitor specific PID
top -d 1 # Refresh every second
watch -n 1 "top -bn1" # Continuous top refresh
uptime # Load averages and uptime
vmstat 1 5 # 5 samples at 1 second intervals
iotop # I/O usage per process
lsof -p 1234 # Files opened by PID
lsof -i :80 # Processes using port 80
5. File Permissions
Permissions are the first line of defense and the first thing auditors check.
# Permission inspection
ls -la /etc/shadow # List with permissions
ls -ld /sensitive_dir # Directory permissions only
stat /file.txt # Detailed file metadata
find / -perm -4000 2>/dev/null # SUID files
find / -perm -2000 2>/dev/null # SGID files
find / -type f -perm -o+w 2>/dev/null # World-writable files
find / -type f -perm -4000 -exec ls -la {} \; # List SUID files with details
# Change permissions
chmod 755 script.sh # Owner rwx, group/others rx
chmod 600 private.key # Owner read/write only
chmod u+s /usr/bin/find # Set SUID bit
chmod -R 700 sensitive_dir/ # Recursive restrictive
chown user:group file.txt # Change owner and group
chown -R user:group /data/ # Recursive ownership change
chgrp developers file.txt # Change group only
6. Compression and Archival
Compressing evidence, packing toolkits, extracting payloads from C2.
# Tar archives
tar -czf archive.tar.gz /path/to/dir # Create gzip compressed
tar -xzf archive.tar.gz # Extract gzip compressed
tar -czf archive.tar.gz --exclude='*.log' /dir # Exclude patterns
tar -tf archive.tar.gz # List contents without extracting
# Gzip compression
gzip file.txt # Compress (creates .gz)
gunzip file.txt.gz # Decompress
gzip -9 file.txt # Maximum compression
# Zip archives
zip -r archive.zip /path/to/dir # Recursive zip
unzip archive.zip # Extract zip
unzip -l archive.zip # List contents
# Other formats
7z a archive.7z /path/to/dir # 7-Zip compression
7z x archive.7z # 7-Zip extraction
bzip2 file.txt # Bzip2 compression
xz file.txt # XZ compression
7. SSH and Remote Access
Remote access is how you pivot.
# Connection and key management
ssh user@host # Connect to remote host
ssh -i key.pem user@host # Connect with specific key
ssh -p 2222 user@host # Non-standard port
ssh -N -L 8080:localhost:80 host # Local port forwarding
ssh -N -R 9090:localhost:22 host # Remote port forwarding
ssh -J jump.host user@destination.host # Jump through bastion host
ssh -o StrictHostKeyChecking=no user@host # Skip host key verification
ssh-copy-id user@host # Install public key
# Key generation and management
ssh-keygen -t ed25519 -C "researcher@lab" # Generate Ed25519 key
ssh-keygen -t rsa -b 4096 -C "researcher@lab" # Generate RSA-4096 key
ssh-keygen -l -f known_hosts # Show key fingerprints
ssh-keyscan host >> ~/.ssh/known_hosts # Add host key manually
# File transfer
scp file.txt user@host:/path/ # Copy file to remote
scp -r dir/ user@host:/path/ # Recursive directory copy
scp -P 2222 file.txt user@host:/path/ # Non-standard port
rsync -avz /local/path/ user@host:/remote/path/ # Sync with progress
rsync -avz --progress /local/ ./remote/ # Local rsync with progress
8. Log Analysis
Logs tell you what happened. Learning to read them separates amateurs from professionals.
# Real-time log monitoring
tail -f /var/log/auth.log # SSH authentication logs
tail -F /var/log/syslog # System logs (follows renames)
journalctl -f # Live systemd journal
journalctl -u ssh --since "1 hour ago" # Service-specific journal
# Historical log review
journalctl -u nginx --since "2024-01-01" --until "2024-01-02"
journalctl -p err..alert # Error level and above
last # Recent logins
lastb # Failed login attempts
last -n 10 # Last 10 entries only
# Log parsing patterns
grep -i "failed\|failure" /var/log/auth.log # Authentication failures
grep "Accepted\|session opened" /var/log/auth.log # Successful logins
awk '{print $1,$2,$3}' /var/log/auth.log | sort -u # Unique timestamps
grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn # Top attacking IPs
awk '$9 == "404"' /var/log/nginx/access.log # Nginx 404s
grep -E "(SELECT|UNION|INSERT|DROP)" /var/log/app.log # SQL injection attempts
9. Security Tools
The heavy hitters. These are what separation of reconnaissance from exploitation looks like.
# Network reconnaissance
nmap -sV target.com # Version detection
nmap -sC target.com # Default script scan
nmap -A target.com # Aggressive scan (OS, versions, scripts)
nmap -p- target.com # Scan all 65535 ports
nmap -sS target.com # SYN stealth scan
nmap -sn target.com # Ping sweep only
nmap --script vuln target.com # Vulnerability scripts
nmap -sU --top-ports 100 target.com # Top 100 UDP ports
# Packet analysis
tcpdump -i eth0 host 192.168.1.1 # Capture traffic to host
tcpdump -i eth0 port 80 # HTTP traffic only
tcpdump -i eth0 -w capture.pcap # Save to file
tcpdump -r capture.pcap -nn # Read captured file
tcpdump -i eth0 -nn 'tcp[tcpflags] & tcp-syn != 0' # SYN packets only
tcpdump -i eth0 -A | grep "password" # Extract credentials from packets
tcpdump -i eth0 -nn 'dst port 443' # TLS traffic
# SSL/TLS analysis
openssl s_client -connect target.com:443 # SSL certificate info
openssl s_client -connect target.com:443 -showcerts
openssl x509 -in cert.pem -text -noout # Certificate details
openssl x509 -in cert.pem -dates # Certificate validity dates
openssl rsa -in key.pem -check # Verify private key
openssl genrsa 4096 > key.pem # Generate RSA key
openssl req -new -key key.pem -out csr.pem # Generate CSR
10. Privilege Escalation Checks
Before you escalate, enumerate. Missed misconfigurations cost engagements.
# Sudo enumeration
sudo -l # User's sudo privileges
sudo -l -U username # Check another user's sudo rights
sudo cat /etc/shadow # Common misconfiguration read
# Kernel and kernel module checks
uname -r # Kernel version
uname -a # Full kernel info
cat /proc/version # Kernel version string
dpkg -l | grep linux-image # Installed kernel packages (Debian)
rpm -qa kernel # Installed kernels (RHEL)
lsmod # Loaded kernel modules
find / -name "*exploit*" 2>/dev/null # Common exploit filenames
gcc --version # Check if compiler available
python --version # Python availability
perl --version # Perl availability
# Enumeration helpers
linpeas.sh # Automated Linux enumeration
linux-exploit-suggester # Kernel exploit suggestions
privesc-check # PowerShell-style Linux privesc
Quick Reference Summary
| Category | Must-Know Commands |
|---|---|
| Info Gathering |
uname -a, hostname, whoami, id
|
| Networking |
ip, ss, curl, dig, nslookup
|
| File Operations |
find, grep, awk, sed, locate
|
| Processes |
ps, top, htop, kill, pgrep
|
| Permissions |
chmod, chown, find -perm
|
| Compression |
tar, gzip, zip, unzip
|
| SSH |
ssh, scp, rsync, ssh-keygen
|
| Logs |
tail -f, grep, journalctl, awk
|
| Security |
nmap, tcpdump, openssl
|
| PrivEsc |
sudo -l, uname -r, linpeas.sh
|
Final Notes
This list is reference material, not a substitute for hands-on practice. Build a lab VM, run these commands against your own infrastructure, and document what each output means in context. The difference between someone who knows commands and someone who understands systems is the ability to interpret anomalous output under pressure.
Keep this bookmarked. You will need it.
~TrixSec
Top comments (0)