> For the complete documentation index, see [llms.txt](https://mainekhacker-1.gitbook.io/mainekhacker/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mainekhacker-1.gitbook.io/mainekhacker/linux/linux-the-complete-guide-basics-to-advanced.md). # Linux: The Complete Guide — Basics to Advanced ## Linux: The Complete Guide — Basics to Advanced Commands • File System • Permissions • Networking • Security / Ethical-Hacking Tools • Shell Scripting • Practice Questions A beginner-to-intermediate handbook explaining not just *what* each command does, but *why* and *when* you would actually use it — including the networking and reconnaissance commands every ethical hacker relies on daily. > Everywhere in this guide, a leading `$` means the command is run as a normal user, and a leading `#` means it should be run as root (e.g. with `sudo`). *** ### Table of Contents 1. Introduction to Linux 2. The Linux File System Hierarchy 3. Getting Around: Navigation Commands 4. Working with Files & Directories 5. Viewing, Editing & Redirecting Files 6. File Permissions & Ownership 7. Users, Groups & Access Control 8. Process & Service Management 9. Package Management 10. Disk, Memory & System Monitoring 11. Networking Fundamentals in Linux 12. Networking & Security / Ethical-Hacking Commands 13. Text Processing & Searching 14. Archiving, Compression & Transfer 15. Shell Scripting Basics 16. Logs, Cron & System Administration 17. Final Practice Exam (Mixed Questions) *** ### 1. Introduction to Linux #### 1.1 What is Linux? Linux is a free, open-source operating system kernel originally created by Linus Torvalds in 1991. Today, "Linux" usually refers to a full operating system (a "distribution" or "distro") built around that kernel, such as Ubuntu, Debian, Kali Linux, Fedora, CentOS, or Arch. Linux powers most of the world's servers, cloud infrastructure, Android phones, and almost all cybersecurity and penetration-testing tooling. #### 1.2 Why Learn Linux? * Almost every real-world server, cloud VM, and container runs Linux. * Every ethical hacking / penetration testing platform (Kali Linux, Parrot OS, BlackArch) is Linux-based. * The command line gives you far more control, automation power, and transparency than a graphical interface. * Most networking and security tools (nmap, Wireshark/tshark, Metasploit, Burp Suite CLI helpers) are built for or run natively on Linux. #### 1.3 Popular Linux Distributions | Distro | What it is | Why you use it | Typical use | | ----------------- | ---------------------------------------------------------------- | ------------------------------------------------------------------- | ------------------ | | **Ubuntu** | General-purpose, beginner-friendly distro based on Debian. | Great first distro; huge community support and documentation. | Desktop / Server | | **Debian** | Extremely stable, minimal base distro. | Used as the base for many other distros; very reliable for servers. | Server | | **Kali Linux** | Debian-based distro pre-loaded with security & pentesting tools. | Standard OS for ethical hacking, CTFs and security labs. | Security / Pentest | | **CentOS / RHEL** | Enterprise-focused, based on Red Hat. | Common in corporate data centers; uses yum/dnf package manager. | Enterprise Server | | **Arch Linux** | Minimal, highly customizable rolling-release distro. | Preferred by advanced users who want full control of every package. | Advanced desktop | #### 1.4 The Shell & Terminal The **shell** is the program that interprets the commands you type (e.g. Bash, Zsh, Fish). The **terminal** (or console) is the window/interface you type into. Bash (Bourne Again SHell) is the default shell on most distributions and is the shell used throughout this guide. ```bash $ echo $SHELL /bin/bash ``` > **Note:** You'll see `$SHELL` style output throughout this guide — these are live examples you can run yourself. **Practice / Interview Questions** **Q1. What is the difference between Linux and a Linux distribution?** Ans: Linux itself is just the kernel — the core program that manages hardware, memory, and processes. A distribution packages that kernel together with system tools, package managers, and (often) a desktop environment into a complete, installable operating system. **Q2. Why is Kali Linux popular for ethical hacking?** Ans: It comes pre-installed with hundreds of security and penetration-testing tools (nmap, Metasploit, Wireshark, John the Ripper, etc.) already configured, saving setup time for security professionals and learners. **Q3. What is a shell?** Ans: A shell is a command-line interpreter that reads the commands a user types and executes them; Bash is the most common shell on Linux. *** ### 2. The Linux File System Hierarchy #### 2.1 Everything is a File In Linux, almost everything — regular files, directories, hard drives, even devices like your keyboard — is represented as a file. This unifying idea makes the system predictable and scriptable. #### 2.2 Key Top-Level Directories | Directory | What it holds | Why it matters | Example | | ------------------ | -------------------------------------------------- | ------------------------------------------------------------------- | ----------------- | | `/` | The root directory — top of the entire tree. | Every other file and directory branches from here. | `cd /` | | `/home` | Personal directories for each user. | Your personal files, downloads, and configs live here. | `/home/alex` | | `/etc` | System-wide configuration files. | Almost every service (network, SSH, users) is configured from here. | `/etc/passwd` | | `/var` | Variable data: logs, mail spools, caches. | Look here first when troubleshooting via logs. | `/var/log/syslog` | | `/bin`, `/usr/bin` | Essential user command binaries. | Where common commands like `ls` and `cp` actually live. | `/bin/ls` | | `/sbin` | System administration binaries. | Commands typically needing root, e.g. networking tools. | `/sbin/ifconfig` | | `/tmp` | Temporary files, cleared on reboot. | Safe scratch space for short-lived files. | `/tmp/test.txt` | | `/root` | Home directory of the root (superuser) account. | Not to be confused with `/` — this is root's personal folder. | `/root` | | `/dev` | Device files representing hardware. | Used to interact directly with disks, USB, terminals. | `/dev/sda` | | `/proc` | Virtual filesystem exposing kernel & process info. | Read live system/process information without extra tools. | `/proc/cpuinfo` | #### 2.3 Absolute vs. Relative Paths An **absolute path** always starts from root (`/`) and works no matter where you currently are, e.g. `/home/alex/notes.txt`. A **relative path** is written from your current location, e.g. `notes.txt` or `../notes.txt`. Understanding this distinction matters a lot when writing scripts that must run reliably from any directory. **Practice / Interview Questions** **Q1. Where would you look first to diagnose a crashed service?** Ans: In `/var/log`, which stores system and application log files. **Q2. What is the difference between an absolute and a relative path?** Ans: An absolute path starts at the root `/` and is unambiguous from anywhere; a relative path is interpreted starting from the current working directory. **Q3. What does the `/etc` directory typically contain?** Ans: System-wide configuration files for the OS and installed services, such as `/etc/passwd` (user accounts) and `/etc/hosts` (static hostname mappings). *** ### 3. Getting Around: Navigation Commands These are the very first commands every Linux user learns — they let you see where you are, move around, and look at what exists. | Command | What it does | Why you use it | Example | | --------- | ------------------------------------------------ | ------------------------------------------------------------- | ----------------------- | | `pwd` | Prints the current working directory. | Confirms exactly where you are before running other commands. | `$ pwd` | | `ls` | Lists files/directories in the current location. | First thing to check the contents of a folder. | `$ ls -la` | | `cd` | Changes the current directory. | Moves you into another folder to work there. | `$ cd /etc` | | `cd ..` | Moves up one directory level. | Quickly steps back without typing a full path. | `$ cd ..` | | `cd ~` | Moves to your home directory. | Fast way to return to your own space from anywhere. | `$ cd ~` | | `tree` | Shows a directory as a visual tree. | Helps understand nested folder structure at a glance. | `$ tree -L 2` | | `clear` | Clears the terminal screen. | Keeps your terminal readable during long sessions. | `$ clear` | | `history` | Shows previously run commands. | Lets you re-run or audit past commands quickly. | `$ history \| grep ssh` | > **Note:** `ls -la` is one of the most-used commands: `-l` gives a long/detailed listing (permissions, owner, size, date) and `-a` shows hidden files (those starting with a dot). **Practice / Interview Questions** **Q1. What does `ls -la` show that plain `ls` does not?** Ans: The `-l` flag adds a detailed listing (permissions, owner, group, size, modification date) and `-a` additionally reveals hidden files/directories (names starting with a dot), which plain `ls` hides by default. **Q2. How do you return to your home directory from anywhere?** Ans: Run `cd` with no arguments, or `cd ~`. *** ### 4. Working with Files & Directories | Command | What it does | Why you use it | Example | | -------- | ----------------------------------------------- | -------------------------------------------------------------------- | ------------------------- | | `mkdir` | Creates a new directory. | Organizes files by creating project/folder structure. | `$ mkdir project` | | `touch` | Creates an empty file or updates its timestamp. | Quickly creates placeholder files, e.g. for scripts. | `$ touch app.log` | | `cp` | Copies files or directories. | Duplicates files for backup or reuse without moving the original. | `$ cp a.txt b.txt` | | `mv` | Moves or renames files/directories. | Reorganizes files or renames them in one step. | `$ mv old.txt new.txt` | | `rm` | Removes files. | Deletes files you no longer need (use `-r` for directories). | `$ rm -r temp/` | | `rmdir` | Removes an empty directory. | Safer than `rm -r` when you only intend to delete an empty folder. | `$ rmdir empty/` | | `find` | Searches for files matching criteria. | Locates files by name, size, type, or modified date across a tree. | `$ find / -name '*.conf'` | | `locate` | Fast file search using a pre-built index. | Much faster than `find` for simple name lookups on a known system. | `$ locate passwd` | | `ln` | Creates hard or symbolic links. | Lets multiple paths point to the same file without duplicating data. | `$ ln -s a.txt link.txt` | | `stat` | Shows detailed metadata about a file. | Reveals exact timestamps, size, inode and permissions. | `$ stat file.txt` | > **Note:** `rm -rf` permanently deletes without confirmation or a recycle bin — always double-check the path before running it, especially as root. **Practice / Interview Questions** **Q1. What is the difference between `rm` and `rmdir`?** Ans: `rmdir` only removes empty directories, while `rm` (with `-r`) can recursively delete a directory and everything inside it. **Q2. What is the difference between a hard link and a symbolic link?** Ans: A hard link points directly to the same inode as the original file, so it keeps working even if the original is deleted. A symbolic link is a pointer/shortcut to a path, and it breaks if the original file is removed or moved. **Q3. Why is `find` preferred over `locate` for real-time results?** Ans: `find` searches the live file system directly, so it always reflects the current state, while `locate` depends on a periodically updated index that can be out of date. *** ### 5. Viewing, Editing & Redirecting Files #### 5.1 Viewing File Contents | Command | What it does | Why you use it | Example | | ------- | ----------------------------------------------- | -------------------------------------------------------------------- | --------------------------- | | `cat` | Prints entire file contents to the screen. | Quick way to view short files or combine several files. | `$ cat notes.txt` | | `less` | Views file contents one page at a time. | Best for large files — scrollable without loading it all at once. | `$ less big.log` | | `head` | Shows the first lines of a file (default 10). | Quickly previews the start of a file, e.g. a CSV header. | `$ head -n 20 data.csv` | | `tail` | Shows the last lines of a file (default 10). | Checks the newest log entries; `-f` follows the file live. | `$ tail -f /var/log/syslog` | | `nano` | Simple, beginner-friendly terminal text editor. | Easiest editor to quickly edit config files. | `$ nano config.txt` | | `vim` | Powerful modal terminal text editor. | Standard editor on almost every server; very efficient once learned. | `$ vim script.sh` | | `diff` | Compares two files line by line. | Shows exactly what changed between two versions of a file. | `$ diff old.conf new.conf` | | `wc` | Counts lines, words, and characters. | Quickly measures file size in lines/words, e.g. log line counts. | `$ wc -l file.txt` | #### 5.2 Redirection & Pipes Redirection sends command output somewhere other than the screen, and pipes (`|`) feed one command's output as another command's input — this is the core of Linux's "do one thing well, then chain tools together" philosophy. | Operator | What it does | Why you use it | Example | | -------- | ------------------------------------------- | ----------------------------------------------------------- | ------------------------ | | `>` | Redirects output to a file, overwriting it. | Saves command output as a new file. | `$ ls > list.txt` | | `>>` | Redirects output to a file, appending it. | Adds new output to an existing log without erasing history. | `$ echo hi >> log.txt` | | `<` | Feeds a file's contents in as input. | Used when a program expects input from stdin. | `$ mail user < msg.txt` | | `\|` | Pipes one command's output into another. | Chains tools, e.g. filter a process list before reading it. | `$ ps aux \| grep nginx` | **Practice / Interview Questions** **Q1. When would you use `tail -f` instead of `cat`?** Ans: When you want to watch a log file update in real time (e.g. a server log while reproducing a bug) rather than viewing a static snapshot. **Q2. What is the difference between `>` and `>>`?** Ans: `>` overwrites the target file with the new output, while `>>` appends the new output to the end of the existing file. **Q3. What does the pipe `|` operator do?** Ans: It takes the standard output of the command on its left and feeds it in as the standard input of the command on its right, letting you chain simple tools into a more powerful one-line pipeline. *** ### 6. File Permissions & Ownership #### 6.1 Understanding the Permission String Running `ls -l` shows a string like `-rwxr-xr--`. The first character shows the file type (`-` file, `d` directory, `l` symlink). The next nine characters are three groups of three: permissions for the **owner**, the **group**, and **others**, each as `r` (read), `w` (write), `x` (execute). ``` -rwxr-xr-- | owner | group | others | rwx | r-x | r-- ``` #### 6.2 Numeric (Octal) Permissions Each permission has a numeric value: r=4, w=2, x=1. Add them per group to get a 3-digit number, e.g. rwx=7, r-x=5, r--=4, giving 754. | Command | What it does | Why you use it | Example | | ------- | ------------------------------------------- | ------------------------------------------------------------ | ----------------------- | | `chmod` | Changes file/directory permissions. | Restricts or grants read/write/execute access as needed. | `$ chmod 755 script.sh` | | `chown` | Changes file owner (and optionally group). | Hands off a file to another user, e.g. after a deployment. | `$ chown alex file.txt` | | `chgrp` | Changes a file's group ownership. | Grants a whole team access via a shared group. | `$ chgrp devs file.txt` | | `umask` | Sets default permission mask for new files. | Controls the default permissions new files are created with. | `$ umask 022` | | `sudo` | Runs a single command with root privileges. | Performs admin tasks without logging in as root permanently. | `$ sudo apt update` | | `su` | Switches to another user (often root). | Opens a full session as another user for extended work. | `$ su - root` | > **Note:** In security assessments, world-writable files (permissions ending in `...w.` or `777`) and unnecessary SUID binaries are classic privilege-escalation red flags — auditors commonly run `find / -perm -4000 -type f 2>/dev/null` to find SUID files. **Practice / Interview Questions** **Q1. What does `chmod 644` mean on a file?** Ans: Owner gets read+write (6), group gets read-only (4), and others get read-only (4) — a very common permission set for regular, non-executable files such as configs or documents. **Q2. Why is a world-writable file (777) considered a security risk?** Ans: Because any user on the system — not just the owner or group — can modify or overwrite it, which an attacker could exploit to inject malicious content or code. **Q3. What is the difference between `chmod` and `chown`?** Ans: `chmod` changes what actions (read/write/execute) are allowed on a file, while `chown` changes who owns the file (and optionally its group). *** ### 7. Users, Groups & Access Control | Command | What it does | Why you use it | Example | | ------------- | -------------------------------------- | -------------------------------------------------------------- | ------------------------ | | `whoami` | Prints the current logged-in username. | Quickly confirms which account you're operating as. | `$ whoami` | | `id` | Shows user and group IDs. | Verifies exact UID/GID and group memberships. | `$ id` | | `useradd` | Creates a new user account. | Provisions accounts for new team members or services. | `# useradd bob` | | `passwd` | Sets or changes a user's password. | Secures a new account or rotates a compromised password. | `$ passwd bob` | | `usermod` | Modifies an existing user account. | Adds a user to a group or changes their shell/home. | `# usermod -aG sudo bob` | | `userdel` | Deletes a user account. | Removes access for someone who has left a project. | `# userdel -r bob` | | `groups` | Lists groups a user belongs to. | Confirms whether a user has access via group membership. | `$ groups bob` | | `/etc/passwd` | File listing all user accounts. | Central reference for account info (not passwords themselves). | `$ cat /etc/passwd` | | `/etc/shadow` | File storing hashed user passwords. | Where password hashes actually live — readable only by root. | `# cat /etc/shadow` | > **Note:** `/etc/shadow` contains password hashes and is a prime target in privilege-escalation and password-cracking exercises (e.g. with John the Ripper) — that's exactly why normal users cannot read it. **Practice / Interview Questions** **Q1. Where are Linux user passwords actually stored?** Ans: As salted hashes in `/etc/shadow`, which only root can read — `/etc/passwd` only stores account metadata, not the password itself. **Q2. What does `usermod -aG sudo bob` do, and why the `-a` flag?** Ans: It adds user bob to the sudo group so he can run admin commands. The `-a` (append) flag is important — without it, `-G` would replace all of bob's existing group memberships instead of adding to them. *** ### 8. Process & Service Management | Command | What it does | Why you use it | Example | | ----------------- | ----------------------------------------------------- | ---------------------------------------------------------------- | ------------------------ | | `ps` | Snapshot of currently running processes. | Checks what's running right now, e.g. to spot a runaway program. | `$ ps aux` | | `top` | Live, updating view of processes and resource use. | Diagnoses high CPU/memory usage in real time. | `$ top` | | `htop` | Improved, colorized interactive version of top. | Easier process monitoring with sorting and mouse support. | `$ htop` | | `kill` | Sends a signal (often to terminate) a process by PID. | Stops a frozen or misbehaving process. | `$ kill -9 1234` | | `killall` | Kills processes by name instead of PID. | Quickly stops every instance of a named program. | `$ killall firefox` | | `pkill` | Kills processes matching a pattern. | Flexible termination using name/user/other filters. | `$ pkill -u bob` | | `jobs` | Lists background jobs in the current shell. | Tracks tasks you've backgrounded with `&`. | `$ jobs` | | `bg` / `fg` | Resumes a job in background/foreground. | Lets you pause work, do something else, then resume it. | `$ fg %1` | | `nice` / `renice` | Sets/changes a process's CPU priority. | Prevents a heavy job from starving other processes. | `$ nice -n 10 script.sh` | | `systemctl` | Controls systemd services (start/stop/status). | Standard way to manage services like SSH, nginx, firewall. | `$ systemctl status ssh` | > **Note:** `kill -9` (SIGKILL) forces immediate termination and should be a last resort — try a plain `kill` (SIGTERM) first so the program can shut down cleanly. **Practice / Interview Questions** **Q1. What is the difference between `kill` and `kill -9`?** Ans: Plain `kill` sends SIGTERM, asking the process to shut down gracefully (saving state, closing files); `kill -9` sends SIGKILL, which force-terminates it immediately with no chance to clean up. **Q2. How would you check if the SSH service is running and restart it?** Ans: Use `systemctl status ssh` to check, and `systemctl restart ssh` (as root/sudo) to restart it. **Q3. What information does `ps aux` give you?** Ans: A snapshot of all running processes system-wide, including the owning user, PID, CPU/memory usage, and the command that launched it. *** ### 9. Package Management Package managers install, update, and remove software along with its dependencies, so you never have to manually track down and compile programs. #### Debian / Ubuntu family (APT) | Command | What it does | Why you use it | Example | | ------------- | --------------------------------------------------- | ----------------------------------------------------------------------- | ------------------------- | | `apt update` | Refreshes the local list of available packages. | Ensures you install the latest available versions and security patches. | `$ sudo apt update` | | `apt upgrade` | Upgrades all installed packages to newest versions. | Keeps the system patched against known vulnerabilities. | `$ sudo apt upgrade` | | `apt install` | Installs a new package. | Adds new software, e.g. a networking tool. | `$ sudo apt install nmap` | | `apt remove` | Uninstalls a package (keeps config files). | Removes software you no longer need. | `$ sudo apt remove nmap` | | `apt purge` | Uninstalls a package and its config files. | Fully cleans up a package, including leftover settings. | `$ sudo apt purge nmap` | | `dpkg -l` | Lists all installed `.deb` packages. | Audits exactly what's installed on a Debian-based system. | `$ dpkg -l \| grep ssh` | #### Red Hat / CentOS / Fedora family (YUM / DNF) | Command | What it does | Why you use it | Example | | ------------- | --------------------------------------------- | --------------------------------------------------- | ------------------------- | | `dnf install` | Installs a package (modern successor to yum). | Adds software on RHEL/Fedora/CentOS systems. | `$ sudo dnf install nmap` | | `yum update` | Updates all packages (older RHEL/CentOS). | Patches the system on legacy Red Hat-based distros. | `$ sudo yum update` | | `rpm -qa` | Lists all installed RPM packages. | Audits software installed via the RPM system. | `$ rpm -qa \| grep httpd` | **Practice / Interview Questions** **Q1. What is the difference between `apt remove` and `apt purge`?** Ans: `apt remove` uninstalls the package but leaves its configuration files behind; `apt purge` removes the package and deletes its configuration files too, giving a fully clean uninstall. **Q2. Why should you run `apt update` before `apt install`?** Ans: `apt update` refreshes the local package index from the repositories, so `apt install` fetches the latest available version and correct dependency information rather than stale, possibly unavailable data. *** ### 10. Disk, Memory & System Monitoring | Command | What it does | Why you use it | Example | | ------------------ | ------------------------------------------------------------ | --------------------------------------------------------------------- | ----------------------------- | | `df -h` | Shows disk space usage per mounted filesystem. | Checks if a disk/partition is running out of space. | `$ df -h` | | `du -sh` | Shows the total size of a file or directory. | Finds what's consuming disk space, e.g. a bloated log folder. | `$ du -sh /var/log` | | `free -h` | Shows RAM and swap usage. | Diagnoses memory pressure or leaks. | `$ free -h` | | `uptime` | Shows how long the system has been running and load average. | Quick health check of overall system load. | `$ uptime` | | `uname -a` | Shows kernel and system information. | Identifies OS/kernel version, important for exploit research. | `$ uname -a` | | `lscpu` | Shows CPU architecture details. | Confirms core count/architecture, e.g. before compiling software. | `$ lscpu` | | `lsblk` | Lists block devices (disks/partitions). | Sees attached drives and partitions before mounting. | `$ lsblk` | | `mount` / `umount` | Attaches or detaches a filesystem. | Makes an external drive or partition accessible or safely removes it. | `$ sudo mount /dev/sdb1 /mnt` | | `vmstat` | Reports memory, CPU, and I/O statistics. | Diagnoses performance bottlenecks over a time interval. | `$ vmstat 2 5` | **Practice / Interview Questions** **Q1. How do you check if a Linux server is running low on disk space?** Ans: Run `df -h` to see per-partition free space at a glance, and `du -sh /some/dir` to drill down into what's consuming the space. **Q2. Why is `uname -a` relevant during a security assessment?** Ans: It reveals the exact kernel version and architecture, which testers use to check for known, version-specific kernel vulnerabilities and applicable privilege-escalation exploits. *** ### 11. Networking Fundamentals in Linux Before diving into security-focused tools, you need a firm grip on the basic commands used to inspect, configure, and troubleshoot a network connection. | Command | What it does | Why you use it | Example | | -------------------- | ---------------------------------------------------- | ---------------------------------------------------------------------------- | ------------------------------------- | | `ip a` | Shows all network interfaces and their IP addresses. | Modern replacement for `ifconfig`; confirms your machine's IP. | `$ ip a` | | `ifconfig` | Legacy command showing/configuring interfaces. | Still common on older systems for a quick interface overview. | `$ ifconfig` | | `ping` | Sends ICMP echo requests to test reachability. | First step to check if a host is up and reachable. | `$ ping 8.8.8.8` | | `traceroute` | Shows the network path (hops) to a destination. | Diagnoses where along a route latency or a drop occurs. | `$ traceroute google.com` | | `hostname` | Shows or sets the system's hostname. | Confirms machine identity on the network. | `$ hostname` | | `netstat` | Shows network connections, routing tables, ports. | Classic tool to see what's listening/connected (largely superseded by `ss`). | `$ netstat -tulnp` | | `ss` | Modern, faster replacement for netstat. | Quickly lists open sockets/listening ports on the host. | `$ ss -tulnp` | | `route` / `ip route` | Shows or edits the routing table. | Confirms which gateway traffic will use to leave the network. | `$ ip route` | | `dig` | Queries DNS records for a domain. | Investigates how a domain resolves, e.g. MX or A records. | `$ dig example.com` | | `nslookup` | Simple DNS lookup tool. | Quick alternative to `dig` for resolving a hostname to an IP. | `$ nslookup example.com` | | `curl` | Transfers data to/from a URL from the command line. | Tests an API/web endpoint or downloads a file without a browser. | `$ curl -I https://example.com` | | `wget` | Downloads files from the web. | Non-interactively fetches files/pages, e.g. in scripts. | `$ wget https://example.com/file.zip` | | `ssh` | Securely logs into a remote machine. | Standard, encrypted way to administer remote Linux servers. | `$ ssh user@192.168.1.10` | | `scp` | Securely copies files between hosts over SSH. | Transfers files to/from a remote server safely. | `$ scp file.txt user@host:/tmp/` | > **Note:** `netstat` is deprecated on many modern distros in favor of `ss` and `ip`, but you will still see it constantly in tutorials, exam objectives, and older systems, so it's worth knowing both. **Practice / Interview Questions** **Q1. What is the difference between `ping` and `traceroute`?** Ans: `ping` only tells you whether a host is reachable and the round-trip time; `traceroute` shows every intermediate hop (router) along the path, which helps pinpoint exactly where a connectivity problem is occurring. **Q2. What does `ss -tulnp` show, and why is each flag useful?** Ans: It lists listening sockets: `-t` (TCP), `-u` (UDP), `-l` (listening only), `-n` (show numeric ports/addresses instead of resolving names), and `-p` (show the process using each socket) — together giving a fast picture of what services are exposed on the machine. **Q3. Why use `dig` instead of just opening a browser to check DNS?** Ans: `dig` queries DNS records directly and shows the raw response (record type, TTL, authoritative server), which is far more precise for diagnosing DNS issues than relying on what a browser happens to display. *** ### 12. Networking & Security / Ethical-Hacking Commands These are the commands most associated with network reconnaissance, enumeration, and defensive security work. They are standard, legitimate administration and auditing tools — always use them only on systems and networks you own or are explicitly authorized to test. #### 12.1 Reconnaissance & Host Discovery | Command | What it does | Why you use it | Example | | ---------- | ------------------------------------------------------------- | ----------------------------------------------------------------------- | ---------------------------- | | `nmap` | Network scanner: discovers hosts, open ports, services. | The core recon tool — maps out what's alive and listening on a network. | `$ nmap -sV 192.168.1.0/24` | | `nmap -A` | Aggressive scan: OS detection, versions, traceroute, scripts. | Gathers deep information about a single target in one pass. | `$ nmap -A 192.168.1.10` | | `nmap -p-` | Scans all 65535 TCP ports instead of the default top 1000. | Ensures no open port is missed during a thorough assessment. | `$ nmap -p- target.com` | | `masscan` | Extremely fast port scanner for large IP ranges. | Scans huge networks far quicker than nmap when speed matters. | `$ masscan -p80 10.0.0.0/8` | | `whois` | Looks up domain/IP ownership registration data. | Identifies who owns a domain during reconnaissance. | `$ whois example.com` | | `arp-scan` | Discovers live hosts on a local network via ARP. | Finds devices on the same LAN segment, even if firewalled. | `$ sudo arp-scan --localnet` | #### 12.2 Traffic Capture & Analysis | Command | What it does | Why you use it | Example | | ----------- | ----------------------------------------------------- | -------------------------------------------------------------------- | -------------------------- | | `tcpdump` | Captures and displays network packets from the CLI. | Inspects raw traffic to diagnose issues or spot suspicious activity. | `$ sudo tcpdump -i eth0` | | `tshark` | Command-line version of Wireshark for packet capture. | Scripted/automated packet analysis without the GUI. | `$ tshark -i eth0 -c 50` | | `wireshark` | GUI packet analyzer (protocol deep-dive). | Visually inspects captured traffic packet by packet. | `$ wireshark capture.pcap` | #### 12.3 Enumeration & Vulnerability Checking | Command | What it does | Why you use it | Example | | ------------- | ------------------------------------------------------ | ------------------------------------------------------------------------------ | ------------------------------------------- | | `netcat (nc)` | Reads/writes raw data over TCP/UDP connections. | The "Swiss-army knife" for banner grabbing, quick transfers, or testing ports. | `$ nc -vz target.com 22` | | `nikto` | Web server scanner checking for known vulnerabilities. | Quickly flags outdated software/misconfigurations on a web server. | `$ nikto -h http://target.com` | | `enum4linux` | Enumerates Windows/Samba shares, users, and policies. | Gathers detail about SMB/AD targets during authorized assessments. | `$ enum4linux -a target.com` | | `smbclient` | Accesses SMB/Windows file shares from Linux. | Lists/connects to shared folders to check exposed data. | `$ smbclient -L //target/` | | `hydra` | Online password brute-force / credential-testing tool. | Tests login strength on services, only with explicit authorization. | `$ hydra -l admin -P list.txt ssh://target` | | `john` | John the Ripper — offline password hash cracker. | Audits password strength from a hash dump in a lab/CTF context. | `$ john --wordlist=rockyou.txt hashes.txt` | #### 12.4 Firewall & Traffic Control | Command | What it does | Why you use it | Example | | ----------- | ----------------------------------------------------------- | -------------------------------------------------------------------- | -------------------------------- | | `iptables` | Configures kernel-level firewall rules. | Blocks or allows traffic to harden a Linux host. | `# iptables -L -n` | | `ufw` | Simplified front-end for iptables (Uncomplicated Firewall). | Easier day-to-day firewall management on Ubuntu/Debian. | `$ sudo ufw allow 22/tcp` | | `firewalld` | Dynamic firewall manager (RHEL/CentOS/Fedora). | Manages zones/rules on Red Hat-family systems. | `$ sudo firewall-cmd --list-all` | | `fail2ban` | Bans IPs showing malicious login behavior. | Automatically blocks brute-force attempts against services like SSH. | `$ sudo fail2ban-client status` | > **Legal & ethical reminder:** scanning, enumerating, or attacking any system or network without explicit, written authorization is illegal in most jurisdictions. Practice these tools only against systems you own or environments built for this purpose (e.g. TryHackMe, HackTheBox, your own lab VMs). **Practice / Interview Questions** **Q1. What is the purpose of an nmap scan, and what does `nmap -sV` add?** Ans: nmap discovers which hosts are up and which ports are open on them. The `-sV` flag additionally probes each open port to determine the service and version running there, which helps identify potentially vulnerable software. **Q2. What is the difference between tcpdump and nmap?** Ans: nmap actively probes a target to discover open ports and services; tcpdump passively captures and displays the actual network packets flowing on an interface, useful for analyzing traffic content and protocol behavior rather than discovering hosts. **Q3. Why would a penetration tester use netcat for "banner grabbing"?** Ans: Connecting to an open port with netcat often causes the service to send back an identifying banner (e.g. software name and version), which helps the tester fingerprint the service without a full vulnerability scan. **Q4. What does `iptables -L -n` do?** Ans: It lists (`-L`) the current firewall rules with numeric (`-n`) IP addresses and ports instead of resolving them to hostnames/service names, which is both faster and clearer when auditing rules. **Q5. Why must brute-force tools like hydra or password crackers like John the Ripper only be used with authorization?** Ans: Using them against systems or accounts you don't own or have explicit permission to test is unauthorized access, which is illegal under computer-crime laws in most countries — these tools are legitimate only in authorized penetration tests, your own labs, or sanctioned CTF/training environments. *** ### 13. Text Processing & Searching These tools let you search, filter, and transform text at high speed — essential for parsing logs, config files, and command output. | Command | What it does | Why you use it | Example | | ------------------- | ------------------------------------------------------- | ----------------------------------------------------------------------- | ------------------------------------ | | `grep` | Searches text for lines matching a pattern. | Finds relevant lines instantly instead of reading a whole file. | `$ grep -i 'error' app.log` | | `grep -r` | Recursively searches all files in a directory. | Finds a pattern across an entire project or folder tree. | `$ grep -r 'TODO' ./src` | | `egrep` / `grep -E` | grep with extended regular expressions. | Allows richer pattern matching (e.g. alternation with `\|`). | `$ grep -E 'fail\|error' log.txt` | | `sed` | Stream editor for find/replace and text transformation. | Edits text in-place or in a pipeline without opening an editor. | `$ sed 's/foo/bar/g' file.txt` | | `awk` | Pattern-scanning and text-processing language. | Extracts and processes columns of structured text, e.g. logs. | `$ awk '{print $1}' access.log` | | `cut` | Extracts sections (columns) from each line. | Simple column extraction, e.g. pulling a field from CSV. | `$ cut -d',' -f2 data.csv` | | `sort` | Sorts lines of text. | Orders output, e.g. alphabetically or numerically, before analysis. | `$ sort -n numbers.txt` | | `uniq` | Filters/reports repeated adjacent lines. | Removes duplicates or counts occurrences after sorting. | `$ sort file \| uniq -c` | | `xargs` | Builds and runs commands from piped input. | Passes a list of items into a command that doesn't read stdin directly. | `$ find . -name '*.tmp' \| xargs rm` | **Practice / Interview Questions** **Q1. How would you count how many times "Failed password" appears in an auth log (a classic brute-force indicator)?** Ans: `grep -c 'Failed password' /var/log/auth.log` — the `-c` flag makes grep print a count of matching lines instead of the lines themselves. **Q2. What is the practical difference between `sed` and `awk`?** Ans: `sed` is primarily for simple line-based find-and-replace / text substitution, while `awk` is a fuller pattern-scanning language built for working with structured, column-based data (like extracting or computing on specific fields). *** ### 14. Archiving, Compression & Transfer | Command | What it does | Why you use it | Example | | ----------------- | --------------------------------------------- | ----------------------------------------------------------- | ------------------------------------ | | `tar` | Bundles multiple files into a single archive. | Packages a whole directory for backup or transfer. | `$ tar -cvf backup.tar folder/` | | `tar -xvf` | Extracts a `.tar` archive. | Unpacks a bundled archive back into individual files. | `$ tar -xvf backup.tar` | | `tar -czvf` | Creates a gzip-compressed tar archive. | Produces a smaller archive by compressing while bundling. | `$ tar -czvf backup.tar.gz folder/` | | `gzip` / `gunzip` | Compresses/decompresses a single file. | Shrinks a file's size for storage or transfer. | `$ gzip file.txt` | | `zip` / `unzip` | Creates/extracts `.zip` archives. | Cross-platform-friendly compressed archive format. | `$ zip -r archive.zip folder/` | | `rsync` | Efficiently synchronizes files/directories. | Copies only changed data, ideal for backups over a network. | `$ rsync -avz src/ user@host:/dest/` | **Practice / Interview Questions** **Q1. Why is `rsync` often preferred over `scp` for backups?** Ans: `rsync` only transfers the parts of files that have changed since the last sync (delta transfer), and can resume interrupted transfers, making it far more efficient than `scp` for repeated backups of large directories. *** ### 15. Shell Scripting Basics A shell script automates a sequence of commands, turning repetitive manual work — including security scans and system checks — into a single reusable file. #### 15.1 A First Script ```bash #!/bin/bash # A simple script that checks if a host is reachable HOST="$1" if ping -c 1 "$HOST" &> /dev/null; then echo "$HOST is UP" else echo "$HOST is DOWN" fi ``` Run it with: `chmod +x check_host.sh && ./check_host.sh 8.8.8.8` #### 15.2 Core Building Blocks | Element | What it does | Why you use it | Example | | ------------- | ----------------------------------------------------------- | --------------------------------------------------------------------- | ------------------------------------------------- | | `#!/bin/bash` | The "shebang" line — tells the OS which interpreter to use. | Ensures the script always runs with Bash regardless of default shell. | `#!/bin/bash` | | `$1, $2, ...` | Positional parameters — arguments passed to the script. | Lets a script accept input instead of hardcoding values. | `./script.sh arg1` | | `if / else` | Conditional branching. | Runs different commands depending on a test's result. | `if [ -f file ]; then ...` | | `for` loop | Repeats a block once per item in a list. | Automates running a command across many items, e.g. IPs. | `for ip in $(cat ips.txt); do ping -c1 $ip; done` | | `while` loop | Repeats a block while a condition holds. | Runs a task repeatedly until a stopping condition is met. | `while true; do ...; done` | | functions | Named, reusable blocks of commands. | Avoids repeating the same logic throughout a script. | `myfunc() { echo hi; }` | | `chmod +x` | Marks a script as executable. | Required before you can run a script directly with `./`. | `$ chmod +x script.sh` | **Practice / Interview Questions** **Q1. Why does a shell script start with `#!/bin/bash`?** Ans: This "shebang" line tells the operating system exactly which interpreter should execute the file, so the script runs consistently regardless of the user's default or currently active shell. **Q2. How would you write a loop to ping every IP address listed in a file called `ips.txt`?** Ans: `for ip in $(cat ips.txt); do ping -c 1 "$ip"; done` — this reads each line of `ips.txt` and runs a single ping against it in turn. *** ### 16. Logs, Cron & System Administration | Command | What it does | Why you use it | Example | | ------------------ | -------------------------------------- | ------------------------------------------------------------------ | ------------------------------- | | `journalctl` | Queries logs collected by systemd. | Central place to review logs on modern systemd-based distros. | `$ journalctl -u ssh -f` | | `dmesg` | Shows kernel ring buffer messages. | Diagnoses hardware/driver/boot issues. | `$ dmesg \| tail` | | `cron` / `crontab` | Schedules recurring automated tasks. | Runs scripts automatically at set times, e.g. nightly backups. | `$ crontab -e` | | `at` | Schedules a one-time task for later. | Runs a single command once at a specified future time. | `$ at 22:00` | | `systemctl enable` | Configures a service to start on boot. | Ensures critical services come back up automatically after reboot. | `$ sudo systemctl enable nginx` | | `who` / `w` | Shows who is currently logged in. | Checks for other active sessions on a shared server. | `$ who` | | `last` | Shows recent login history. | Reviews who has accessed the system recently, useful in audits. | `$ last -n 10` | #### Reading a Crontab Line ``` # minute hour day-of-month month day-of-week command 30 2 * * * /home/user/backup.sh # => runs backup.sh every day at 02:30 ``` **Practice / Interview Questions** **Q1. What does the crontab line `0 * * * * /scripts/check.sh` mean?** Ans: It runs `/scripts/check.sh` at the top of every hour (minute 0), every day, every month, every day of the week. **Q2. How would you check the last 10 logins to a server?** Ans: Run `last -n 10`, which lists the most recent login sessions from the wtmp log. *** ### 17. Final Practice Exam (Mixed Questions) A mixed review set spanning the whole guide — use it to self-test before moving on to hands-on labs. **Q1. Which command shows detailed, long-format listing including hidden files?** Ans: `ls -la` **Q2. What command changes a file's permissions to "owner: read/write/execute, group: read/execute, others: read-only"?** Ans: `chmod 754 filename` **Q3. Which directory holds system-wide configuration files?** Ans: `/etc` **Q4. What is the fastest way to see all listening TCP/UDP ports with their owning process?** Ans: `ss -tulnp` (or the older `netstat -tulnp`) **Q5. What nmap flag performs a full scan of all 65,535 TCP ports?** Ans: `-p-` (e.g. `nmap -p- target`) **Q6. Which command would you use to watch a log file update live?** Ans: `tail -f /path/to/logfile` **Q7. How do you search recursively for the word "password" in every file under the current directory?** Ans: `grep -r 'password' .` **Q8. What signal does `kill -9` send, and how is it different from a plain `kill`?** Ans: It sends SIGKILL, an immediate forced termination with no cleanup, unlike plain `kill` (SIGTERM) which asks the process to exit gracefully. **Q9. Which file stores hashed user passwords on a Linux system?** Ans: `/etc/shadow` **Q10. What is the purpose of `tcpdump`, and how does it differ from nmap?** Ans: `tcpdump` passively captures live network packets for analysis, whereas nmap actively probes hosts/ports to discover what is open and running. **Q11. Which command schedules a script to run automatically every day at 2:30 AM?** Ans: `crontab -e`, then add: `30 2 * * * /path/to/script.sh` **Q12. What is the difference between a hard link and a symbolic link?** Ans: A hard link shares the same inode as the original file and survives if the original is deleted; a symbolic link is a path pointer that breaks if the target is removed or moved. **Q13. How would you find every file on the system with the SUID bit set (a common privilege-escalation check)?** Ans: `find / -perm -4000 -type f 2>/dev/null` **Q14. What does `rsync -avz src/ user@host:/dest/` do?** Ans: Synchronizes the `src/` directory to a remote host efficiently, using archive mode (`-a`, preserves permissions/timestamps), verbose output (`-v`), and compression during transfer (`-z`). **Q15. Why is authorization required before running tools like nmap, hydra, or John the Ripper against a target?** Ans: Scanning, brute-forcing, or cracking credentials on systems you don't own or have explicit written permission to test is unauthorized access and illegal in most jurisdictions, regardless of intent. *** *End of guide. Practice every command in a safe lab or your own VM, and always scan/test only what you're authorized to.*