Everything in Linux is a file, and everything lives under one unified root. Windows uses drive letters (C:\, D:\); Linux has a single unified tree starting at /.

Core Directories & Architectural Roles

Navigating Linux with speed requires understanding exactly where configuration files, logs, volatile memory pointers, and binaries reside on disk:

Every file and directory in Linux has an owner, an assigned group, and a permission mode string. Mastering this notation is mandatory — permission misconfigurations represent the single most common privilege escalation vector in Linux security.

Reading Permission Strings

Executing ls -la outputs permission strings broken down into four distinct segments:

-rwxr-xr--  1 kalki  security  4096  Sep 11  10:02  deploy.sh
│└──┬──┘└──┬──┘└──┬──┘
│   │      │      └── Other: r-- (read only = 4)
│   │      └───────── Group: r-x (read + execute = 5)
│   └──────────────── Owner: rwx (read + write + execute = 7)
└──────────────────── File Type: - = regular file, d = directory, l = symlink

Numeric (Octal) Permissions

Permissions are computed using binary weight additions (r=4, w=2, x=1):

chmod 754 deploy.sh
  7 = Owner: rwx (4 + 2 + 1) -> Full control
  5 = Group: r-x (4 + 0 + 1) -> Read and execute
  4 = Other: r-- (4 + 0 + 0) -> Read-only

Key Permission Management Commands

SUID, SGID & Sticky Bit — The Exploitation Angle

A binary with the SUID (Set User ID) bit enabled executes with the privileges of the file owner rather than the user invoking it. For example, /usr/bin/passwd is owned by root and has SUID set (-rwsr-xr-x) so that normal users can update /etc/shadow when changing their password.

-rwsr-xr-x  1 root root  /usr/bin/passwd
   ▲
   └── s = SUID bit set (replaces 'x' in the owner's execute field)

grep, awk, sed, find, ps, and ss are not optional utilities — they represent the foundation of log parsing, artifact triage, and live forensic investigation.

Core Tooling Matrix (One-Click Copy)

Chaining Commands — The Security Engineer's Weapon

Individual tools become exponentially more effective when chained together with UNIX pipes (|). This enables rapid log parsing and intrusion detection directly in the terminal:

cat /var/log/auth.log | grep "Failed password" | awk '{print $11}' | sort | uniq -c | sort -nr

Knowing what is actively executing, what initializes at boot, and what runs on schedule is critical for both offensive persistence and defensive anomaly detection.

Process & Service Control Commands

Cron Scheduling Syntax

*  *  *  *  *  command_to_execute
│  │  │  │  │
│  │  │  │  └── Day of Week (0 - 6, where Sunday = 0 or 7)
│  │  │  └───── Month of Year (1 - 12)
│  │  └──────── Day of Month (1 - 31)
│  └─────────── Hour of Day (0 - 23 in 24h format)
└────────────── Minute of Hour (0 - 59)

Example: 0 2 * * * /opt/backup.sh  -> Runs every single day at 02:00 AM sharp

You don't need to write monolithic software in Bash. You need enough scripting fluency to automate reconnaissance, batch-parse network artifacts, and chain disparate security tools together.

The Core Scripting Building Blocks

#!/bin/bash

# 1. Variables (no spaces around '=')
target="192.168.1.0/24"

# 2. File Conditionals
if [ -f "/etc/shadow" ]; then
  echo "[+] /etc/shadow is accessible"
fi

# 3. For Loop over a Sequence
for ip in 10 20 30 40 50; do
  ping -c 1 -W 1 "192.168.1.$ip" > /dev/null && echo "Host $ip is UP"
done

# 4. While Loop reading line-by-line
while read -r domain; do
  echo "Resolving: $domain"
  host "$domain"
done < targets.txt

# 5. Functions
scan_host() {
  echo "Running Nmap on: $1"
  nmap -sV -p 22,80,443 "$1"
}

scan_host "192.168.1.1"

A Real-World Recon Script (quick_recon.sh)

A fast ping-sweep automation script written in under 5 minutes to discover live hosts across an entire subnet:

#!/bin/bash
# quick_recon.sh — ping-sweep a /24 subnet and report live hosts
subnet="192.168.1"

echo "[*] Starting sweep on subnet: $subnet.0/24"

for i in $(seq 1 254); do
  ip="$subnet.$i"
  if ping -c 1 -W 1 "$ip" &> /dev/null; then
    echo "[LIVE HOST] -> $ip"
  fi
done

echo "[*] Subnet sweep completed."

Kali is a Debian-derived distribution maintained by Offensive Security, pre-configured with hundreds of specialized tools across every phase of an engagement.

Security Tool Categories & Standard Weapons

Fresh Kali Installation Hardening Checklist

SSH (Secure Shell) is the industry standard for remote administration, lab connectivity, CTF challenges, and multi-hop network pivoting.

Key SSH Commands & Tunneling Flags

You need an isolated, virtualized playground to test exploits and capture traffic without ever touching production systems or violating legal boundaries.

5-Step Home Lab Architecture Blueprint

Virtual Network Modes Comparison

Check these off as you complete your daily drills. Your progress is automatically saved in your browser's local storage.

Recommended Platforms for Continued Practice