PWNMI

Guides

Linux Fundamentals Every Beginner Hacker Needs

Updated July 22, 2026 · Written by PWNMI — see About.

Almost every offensive security tool either runs on Linux or was built with Linux users in mind. You don't need to become a sysadmin, but you need enough comfort with the command line that it stops being the obstacle between you and the actual work.

pwd                  # where am I
ls -la                # list everything, including hidden files, with details
cd /path/to/dir       # move
find / -name "*.conf" 2>/dev/null   # search the filesystem for a pattern

find is worth spending real time on — it's how you'll search for config files, writable directories, and SUID binaries during privilege escalation later on.

File permissions (this one matters a lot)

Linux permissions are the single most-tested concept in beginner CTF rooms:

-rwxr-xr-x  1 user group  file.sh

That's read/write/execute for the owner, read/execute for the group, read/execute for everyone else. chmod +x file.sh makes something executable; chmod 755 file.sh sets those permissions explicitly using octal notation (7 = rwx, 5 = r-x).

SUID binaries — files that run with the file owner's permissions rather than the executing user's — are one of the most common privilege escalation vectors. Finding them:

find / -perm -4000 -type f 2>/dev/null

Once you're landing on boxes with scripts running as root via cron or sudo, see the script privesc checklist for how to actually analyze one.

Processes and services

ps aux                # what's running
top                    # live view, resource usage
systemctl status <name>   # check a service's status (on systemd distros)
netstat -tulpn         # what's listening on which ports (or `ss -tulpn` on newer systems)

Piping and redirection

This is what makes the command line actually powerful instead of just a list of individual commands:

cat access.log | grep "POST" | wc -l    # count POST requests in a log file
command > output.txt                     # redirect output to a file, overwrite
command >> output.txt                    # redirect output to a file, append

Basic Bash scripting

You don't need to be a programmer, but a script like this should make sense to you:

#!/bin/bash
for ip in $(cat targets.txt); do
  nmap -sV "$ip" -oN "scan_$ip.txt"
done

A loop over a list of targets, running a scan against each one and saving results. That pattern — loop, run a tool, save output — covers a huge fraction of the automation you'll actually write early on.

Common mistakes

  • Avoiding the terminal in favor of GUI tools whenever possible. It slows you down long-term and most real tooling assumes CLI fluency.
  • Not understanding permissions before jumping into privilege escalation content. SUID/SGID exploitation makes no sense until the permission model does.
  • Copy-pasting commands you don't understand, especially anything piped into a shell (curl ... | bash). Read what a script does before running it — this applies doubly when you're the one being handed a script during an engagement.

Next step

Once this is comfortable, move on to Nmap fundamentals if you haven't already, then start applying all of it in Labs.