Linux Fundamentals for Hackers

# Navigate the filesystem
ls -la /etc          # Long listing with hidden files
ls -lah /home        # Human-readable sizes
find / -name "*.conf" 2>/dev/null   # Find all config files
find / -perm -4000 2>/dev/null      # Find SUID binaries (privesc gold)

# Change permissions
chmod 755 script.sh       # rwxr-xr-x
chmod +x script.sh        # Add execute for all
chmod 600 id_rsa          # rw------- (SSH key must be this)

# Change ownership
chown user:group file.txt
chown root:root /etc/passwd

# Who am I?
id                    # uid, gid, groups
whoami                # just the username
groups                # group memberships

# User information
cat /etc/passwd       # All accounts (username:x:uid:gid:info:home:shell)
cat /etc/shadow       # Password hashes (root-readable only)
cat /etc/group        # Group definitions

# Switch users
su - username         # Become username (needs their password)
sudo -l               # What can current user run as root?
sudo su               # Become root if sudo permits

# List running processes
ps aux              # All processes, full format
ps aux | grep nginx # Filter for specific process
pstree              # Process tree

# Real-time process monitor
top
htop               # Better version (may need install)

# Process management
kill PID            # Send SIGTERM (graceful stop)
kill -9 PID         # Send SIGKILL (immediate stop)
killall processname

# Background jobs
command &           # Run in background
jobs                # List background jobs
fg %1               # Bring job 1 to foreground
Ctrl+Z              # Suspend current process

# Find cron jobs
cat /etc/crontab
ls -la /etc/cron*
crontab -l          # Current user's cron

# Check running services
systemctl list-units --type=service --state=running
netstat -tlnp       # Listening ports with PIDs (requires root for PIDs)
ss -tlnp            # Modern replacement for netstat

# Copy, move, delete
cp source dest
cp -r dir/ dest/    # Recursive copy
mv source dest      # Move / rename
rm file             # Delete
rm -rf dir/         # Delete directory recursively (no undo)

# Create
touch filename      # Create empty file / update timestamp
mkdir -p a/b/c      # Create nested directories

# Read files
cat file            # Print entire file
less file           # Paginated view
head -20 file       # First 20 lines
tail -20 file       # Last 20 lines
tail -f /var/log/syslog   # Follow live log updates

# Search within files
grep "password" /etc/*.conf
grep -r "api_key" /var/www/   # Recursive search
grep -i "admin" file.txt       # Case-insensitive
grep -v "^#" /etc/hosts        # Exclude comments

# Pipes — output of one command > input of next
cat /etc/passwd | grep bash    # Find users with bash shell
ps aux | awk '{print $1}' | sort -u   # Unique list of process owners

# awk — column-based processing
cat /etc/passwd | awk -F: '{print $1, $3}'   # Username and UID
awk '{print $NF}' file.txt                    # Last column

# sed — stream editor
sed 's/foo/bar/g' file.txt     # Replace all 'foo' with 'bar'
sed '/^#/d' file.txt           # Delete comment lines

# sort and uniq
sort file.txt | uniq           # Remove duplicates
sort file.txt | uniq -c        # Count occurrences
sort -n numbers.txt            # Numeric sort

# cut — extract columns
cut -d: -f1 /etc/passwd        # First field, colon delimiter
cut -d, -f1,3 data.csv         # Fields 1 and 3

# tr — translate characters
echo "HELLO" | tr 'A-Z' 'a-z'  # Convert to lowercase

# Interface info
ip addr show       # IP addresses
ip link show       # Network interfaces
ifconfig           # Older syntax

# Connectivity
ping -c 4 8.8.8.8
curl -I https://target.com     # HTTP headers only
wget https://target.com/file   # Download file

# Open connections
netstat -antp      # All TCP connections with PIDs
ss -antp           # Modern netstat
lsof -i :80        # What's on port 80?

# DNS
nslookup target.com
dig target.com
host target.com

# Transfer files
scp file.txt user@host:/tmp/
scp user@host:/etc/passwd .
nc -lvnp 4444 > received.txt   # Receive via netcat
nc target 4444 < file.txt      # Send via netcat

#!/bin/bash
# Make executable: chmod +x script.sh

# Variables
TARGET="192.168.1.0"
PORT=80

# Input
read -p "Enter target: " TARGET

# Conditionals
if [[ -f "/etc/shadow" ]]; then
  echo "Can read shadow file!"
fi

if [[ $UID -eq 0 ]]; then
  echo "Running as root"
else
  echo "Not root — UID: $UID"
fi

# Loops
for i in {1..254}; do
  ping -c 1 -W 1 192.168.1.$i &>/dev/null && echo "192.168.1.$i is alive"
done

# Command substitution
HOSTNAME=$(hostname)
USER_LIST=$(cat /etc/passwd | cut -d: -f1)

# Functions
check_port() {
  nc -zv $1 $2 2>/dev/null && echo "Port $2 open"
}
check_port 192.168.1.1 80

# History
history              # All previous commands
!!                   # Repeat last command
!ssh                 # Repeat last command starting with 'ssh'
Ctrl+R               # Reverse search through history

# Navigation shortcuts
Ctrl+A               # Jump to start of line
Ctrl+E               # Jump to end of line
Ctrl+W               # Delete last word
Alt+.                # Insert last argument of previous command

# Redirection
command > file.txt   # Redirect stdout (overwrite)
command >> file.txt  # Redirect stdout (append)
command 2> err.txt   # Redirect stderr
command 2>/dev/null  # Discard errors
command &> all.txt   # Redirect both stdout and stderr

# Here-doc — multiline input
cat << EOF
line one
line two
EOF