Linux command basics

In a nutshell Linux is driven through the terminal — you type text commands, the system runs them. It's faster than the GUI and, crucially, it automates. Here's the base vocabulary you keep coming back to: moving around, reading, searching, combining. A living reference, topped up as you learn.

One tree from the root /; a few branches you'll live in.

How a command is built

command  -flags  arguments
   ls      -la    /home

command — what to do (ls).
flags (options) — how exactly, starting with - (-l detailed, -a including hidden). Often combined: -la = -l -a.
arguments — on what (/home).

Help for any command: command --help (brief) or man command (the full manual, quit with q).

The file system — a tree

Linux is one big tree of folders, starting at the root /. Important branches:

Path	What's there
`/`	the root, the start of everything
`/home/user`	the user's home folder (files, settings)
`/etc`	configuration for the system and programs
`/root`	the superuser root's home folder
`/tmp`	temporary files (often world-writable)
`/var/log`	logs
`/bin`, `/usr/bin`	the programs (commands) themselves

Paths come as:

absolute — from the root: /home/user/notes.txt (always unambiguous).
relative — from where you are now: notes.txt, ../file (.. — the folder above, . — the current one).

Moving around and looking

Command	What it does	Example
`pwd`	where am I (full path)	`pwd`
`ls`	what's in the folder	`ls -la` (detailed + hidden)
`cd`	change directory	`cd /etc`, `cd ..`, `cd` (home)
`cat`	print a file whole	`cat /etc/passwd`
`less`	read a file page by page	`less big.log` (quit `q`)
`head` / `tail`	start / end of a file	`tail -n 20 log.txt`

Hidden files start with a dot (.bashrc, .ssh). A plain ls hides them — you need ls -a. They often hold keys, command history, configs — valuable during recon on a machine.

Working with files and folders

Command	What it does
`touch file`	create an empty file
`mkdir folder`	create a folder
`cp what where`	copy
`mv what where`	move / rename
`rm file`	delete (`rm -r folder` — a folder with contents)
`nano file`	a simple text editor (quit Ctrl+X)

rm -r doesn't ask and doesn't use a recycle bin — it deletes at once and for good. Double-check the path.

Search

find — search for files by properties:

find / -name "flag.txt"           # by name across the whole system
find /home -type f -name "*.conf" # files only, by mask
find / -perm -4000 2>/dev/null    # SUID files (useful in PrivEsc)

grep — search for text inside:

grep "password" config.txt        # lines with the word
grep -r "admin" /etc/             # recursively through a folder
grep -i "error" log.txt           # case-insensitive

locate name — a fast search over a pre-built database (not always fresh).

2>/dev/null at the end is a trick: hide error messages (e.g. "permission denied") so that only the finds remain in the output.

Operators — joining commands

Operator	What it does	Example
`\|`	pipe: one command's output → into another's input	`cat f.txt \| grep admin`
`>`	write output to a file (overwrite)	`ls > list.txt`
`>>`	append output to the end of a file	`echo line >> log.txt`
`&&`	the second command only if the first succeeded	`cd dir && ls`
`&`	run in the background	`./script.sh &`
`2>/dev/null`	throw away errors	`find / -name x 2>/dev/null`

The pipe \| is the most important. It builds complex processing out of simple commands in one line. Example: cat users.txt \| grep admin \| wc -l — take the file, keep the lines with admin, count them.

Users and permissions (an overview, details later)

whoami — who I am right now.
id — my user and groups (the number uid=0 = root).
sudo command — run as root (if allowed).
root — the superuser, allowed everything. The goal of privilege escalation is to become them.

Every file has permissions for owner/group/others (read r, write w, execute x). In ls -l that's the first column (-rwxr-xr--). Permissions and privilege escalation are covered in the Linux PrivEsc material.

Where recon pays off On a machine, the valuable spots cluster: hidden dotfiles in /home (keys, history), passwords in /etc configs, secrets in /var/log, and world-writable /tmp as a landing pad. Knowing the tree is knowing where to look first.