By Davy Rogers. Use these techniques only in environments you own or have explicit permission to test.

Bash: Getting Around Linux

The Linux command line is your most powerful tool as a penetration tester. Navigating the filesystem, understanding directory structure, and mastering basic commands is absolutely essential. This lesson covers the fundamental skills you need to move around Linux like a pro.

What You'll Learn

  • Linux filesystem structure
  • Essential navigation commands
  • Understanding paths (absolute vs relative)
  • Working with directories
  • Finding files and commands
  • Understanding your current context
  • Command shortcuts and efficiency tips

The Linux Filesystem Hierarchy

Everything Starts at Root:

/
└── Root directory (top of filesystem)

Linux uses forward slashes: /
Windows uses backslashes: \

Everything branches from /

Key Directories:

/
├── bin/        # Essential user binaries (ls, cat, cp)
├── sbin/       # System binaries (iptables, fdisk)
├── etc/        # Configuration files
├── home/       # User home directories
│   └── user/   # Your home directory
├── root/       # Root user's home directory
├── tmp/        # Temporary files (world-writable)
├── var/        # Variable data (logs, caches)
│   └── log/    # Log files
├── usr/        # User programs and data
│   ├── bin/    # User binaries
│   ├── local/  # Locally installed software
│   └── share/  # Shared data
├── opt/        # Optional/add-on software
├── proc/       # Process information (virtual)
├── sys/        # System information (virtual)
├── dev/        # Device files
└── mnt/        # Mount points for external filesystems

Essential Navigation Commands

1. pwd - Print Working Directory

What it does: Shows your current location

pwd

Output:

/home/kali

Use case: Orient yourself when you're lost


2. ls - List Directory Contents

Basic usage:

ls

Shows files and directories in current location.

Common options:

# Long format (permissions, owner, size, date)
ls -l

# Show hidden files (starting with .)
ls -a

# Human-readable sizes
ls -lh

# Sort by modification time (newest first)
ls -lt

# Reverse order
ls -lr

# Combine options
ls -lah

Output examples:

$ ls -lah
total 48K
drwxr-xr-x  6 kali kali 4.0K Jan  1 12:00 .
drwxr-xr-x 20 root root 4.0K Jan  1 11:00 ..
-rw-r--r--  1 kali kali  220 Jan  1 10:00 .bashrc
drwxr-xr-x  2 kali kali 4.0K Jan  1 12:00 Documents
-rw-r--r--  1 kali kali 1.5K Jan  1 11:30 file.txt
drwxr-xr-x  2 kali kali 4.0K Jan  1 12:00 Downloads

Understanding the output:

drwxr-xr-x = Permissions
6          = Number of links
kali       = Owner
kali       = Group
4.0K       = Size
Jan 1      = Date
12:00      = Time
Documents  = Name

List specific directory:

ls /etc
ls /var/log
ls ~/Documents

3. cd - Change Directory

Basic usage:

cd /path/to/directory

Common shortcuts:

# Go to home directory
cd
cd ~

# Go to root directory
cd /

# Go up one level
cd ..

# Go up two levels
cd ../..

# Go to previous directory
cd -

# Go to specific user's home
cd ~username

Examples:

# Absolute path
cd /var/log

# Relative path (from current location)
cd Documents

# Multiple levels
cd ../../etc

# Back and forth
cd /tmp
cd -  # Returns to previous directory

4. tree - Display Directory Tree

Install (if not present):

sudo apt install tree

Usage:

# Show tree of current directory
tree

# Limit depth
tree -L 2

# Show hidden files
tree -a

# Only directories
tree -d

# Show file sizes
tree -h

Output:

.
├── Documents
│   ├── notes.txt
│   └── report.pdf
├── Downloads
│   └── tool.zip
└── scripts
    ├── recon.sh
    └── scan.py

3 directories, 5 files

Understanding Paths

Absolute Paths:

# Start with / (root)
/home/kali/Documents/file.txt
/etc/passwd
/var/log/syslog

Always works regardless of current directory

Relative Paths:

# Relative to current directory
Documents/file.txt
./script.sh
../other_directory/file.txt

Depends on where you are (pwd)

Special Path Symbols:

.   = Current directory
..  = Parent directory
~   = Home directory
-   = Previous directory
/   = Root directory

Examples:

# Current directory
./script.sh
ls .

# Parent directory
cd ..
ls ../

# Home directory
cd ~
ls ~/Documents

# Combining
cd ~/Documents/../../etc  # Works but confusing!

Finding Files and Directories

1. which - Locate a Command

# Find where a command is located
which python3
# Output: /usr/bin/python3

which nmap
# Output: /usr/bin/nmap

2. whereis - Locate Binary, Source, and Manual

whereis ls
# Output: ls: /usr/bin/ls /usr/share/man/man1/ls.1.gz

# Fast search (uses database)
locate file.txt

# Case-insensitive
locate -i FILE.TXT

# Update database (run as root)
sudo updatedb

Note: locate is fast but may not show recently created files until you run updatedb.


# Find by name
find /path -name "filename"

# Case-insensitive
find /path -iname "filename"

# Find directories only
find /path -type d -name "dirname"

# Find files only
find /path -type f -name "filename"

# Find by extension
find /path -name "*.txt"

# Find by size
find /path -size +10M  # Larger than 10MB
find /path -size -1M   # Smaller than 1MB

# Find by modification time
find /path -mtime -7   # Modified in last 7 days
find /path -mtime +30  # Modified more than 30 days ago

# Find and execute
find /path -name "*.log" -delete
find /path -name "*.sh" -exec chmod +x {} \;

Examples:

# Find all Python scripts in current directory
find . -name "*.py"

# Find SUID binaries (privilege escalation!)
find / -perm -4000 -type f 2>/dev/null

# Find writable directories
find / -type d -writable 2>/dev/null

# Find files owned by specific user
find / -user root -name "*.conf" 2>/dev/null

Working with Directories

Create Directories:

# Create single directory
mkdir mydir

# Create multiple directories
mkdir dir1 dir2 dir3

# Create nested directories
mkdir -p parent/child/grandchild

# Create with specific permissions
mkdir -m 755 mydir

Remove Directories:

# Remove empty directory
rmdir dirname

# Remove directory and contents
rm -r dirname

# Force remove without confirmation
rm -rf dirname  # ⚠️ DANGEROUS! No undo!

Understanding Your Context

Who am I?

whoami
# Output: kali

What groups am I in?

groups
# Output: kali sudo netdev

Full user information:

id
# Output: uid=1000(kali) gid=1000(kali) groups=1000(kali),27(sudo)

What system am I on?

hostname
# Output: kali

# Full hostname
hostname -f
# Output: kali.localdomain

# IP address
hostname -I
# Output: 192.168.1.100

What's the OS?

uname -a
# Output: Linux kali 5.18.0-kali5-amd64 #1 SMP PREEMPT_DYNAMIC Debian 5.18.5-1kali6 (2022-07-07) x86_64 GNU/Linux

# Just the kernel version
uname -r
# Output: 5.18.0-kali5-amd64

# OS information
cat /etc/os-release

Command Shortcuts and Tips

Tab Completion:

# Type first few letters, press TAB
cd Doc<TAB>  # Completes to: cd Documents/

# TAB twice to see all options
cd D<TAB><TAB>  # Shows: Desktop/ Documents/ Downloads/

Command History:

# View command history
history

# Search history (Ctrl+R)
# Press Ctrl+R, type search term, press Enter

# Run previous command
!!

# Run command #123 from history
!123

# Run last command starting with "nmap"
!nmap

# Clear history
history -c

Quick Navigation:

# Jump to beginning of line
Ctrl+A

# Jump to end of line
Ctrl+E

# Clear screen
Ctrl+L
# Or: clear

# Cancel current command
Ctrl+C

# Logout/exit shell
Ctrl+D
# Or: exit

Useful Aliases:

Add to ~/.bashrc:

alias ll='ls -lah'
alias la='ls -A'
alias l='ls -CF'
alias ..='cd ..'
alias ...='cd ../..'
alias grep='grep --color=auto'

After adding, reload:

source ~/.bashrc

Practical Exercises

Exercise 1: Navigate the Filesystem

# 1. Where am I?
pwd

# 2. What's here?
ls -la

# 3. Go to root
cd /

# 4. List root directories
ls

# 5. Go to /etc
cd /etc

# 6. Go back home
cd ~

# 7. Go to /var/log
cd /var/log

# 8. Go back to previous directory
cd -

Exercise 2: Find Files

# Find all .txt files in home directory
find ~ -name "*.txt"

# Find all Python scripts
find ~ -name "*.py"

# Find where 'nmap' is installed
which nmap

# Find all files modified today
find ~ -type f -mtime 0

Exercise 3: Explore Directories

# List contents of /etc with details
ls -lah /etc

# Show directory tree of home (2 levels)
tree -L 2 ~

# Find all directories in /var
find /var -type d 2>/dev/null | head -20

Exercise 4: Practice Paths

# Create test structure
mkdir -p ~/test/level1/level2/level3

# Navigate with relative paths
cd ~/test
cd level1
cd ../
cd level1/level2
cd ../../

# Navigate with absolute paths
cd /home/$USER/test/level1/level2/level3
pwd

Common Mistakes to Avoid

1. Not Using Tab Completion:

❌ Typing full paths manually
✅ Use TAB completion

2. Forgetting Where You Are:

# Always check before dangerous commands
pwd
ls

# Then execute
rm -rf dirname

3. Case Sensitivity:

# Linux is case-sensitive!
cd Documents  # ✅
cd documents  # ❌ (if directory is "Documents")

4. Spaces in Paths:

# Use quotes or escape spaces
cd "My Documents"
cd My\ Documents

# Or avoid spaces in filenames!
mkdir my-documents  # Better

5. Dangerous Commands:

# NEVER run without understanding!
rm -rf /    # Deletes EVERYTHING (requires --no-preserve-root)
rm -rf .    # Deletes current directory contents
rm -rf ~    # Deletes your home directory

# Always double-check:
ls dirname    # Confirm it's what you want
rm -rf dirname  # Then delete

Quick Reference

Navigation:
pwd              # Print working directory
ls               # List contents
ls -lah          # Detailed list with hidden files
cd /path         # Change directory
cd ~             # Go home
cd ..            # Go up one level
cd -             # Go to previous directory

Finding:
which cmd        # Find command location
whereis cmd      # Find binary/man page
locate file      # Fast search (uses database)
find / -name f   # Powerful search

Directories:
mkdir dir        # Create directory
mkdir -p a/b/c   # Create nested directories
rmdir dir        # Remove empty directory
rm -r dir        # Remove directory and contents

Context:
whoami           # Current user
hostname         # System name
pwd              # Current location
uname -a         # System information

Shortcuts:
TAB              # Auto-complete
Ctrl+R           # Search history
!!               # Run last command
Ctrl+C           # Cancel command
Ctrl+L           # Clear screen

Resources

Man Pages:

man ls
man cd
man find
man bash

Online Resources:

Practice:


Next Steps

  1. Master these basic commands through daily practice
  2. Memorize the filesystem hierarchy (/etc, /var, /home, etc.)
  3. Use tab completion religiously
  4. Learn find deeply - it's incredibly powerful
  5. Practice on OverTheWire Bandit levels 0-10

Navigation is the foundation of everything else. Master it before moving forward!


"Get lost in Linux so you can find your way around anywhere."