Linux for Hackers

Linux underpins the infrastructure hackers actually attack and the infrastructure they attack from. Most internet-facing servers, cloud instances, containers, IoT devices, and every major pentest distribution (Kali, Parrot OS, BlackArch) run on Linux. Fluency here isn't optional — it's the baseline.

• Attack surface: the majority of servers, routers, and cloud workloads run Linux.
• Tooling: nmap, Metasploit, Burp Suite, John the Ripper, Impacket — all live comfortably in a Linux shell.
• Transparency: open-source means you can read the source of the exact daemon you're attacking.
• Automation: Bash and Python scripting turn manual recon into repeatable, scalable workflows.

Linux organizes everything under a single root /. Knowing what lives where tells you instantly where to look for credentials, configs, logs, and privilege escalation vectors.

Linux permissions are the first wall between a foothold and full compromise. Every file has an owner, a group, and a permission triad (read/write/execute) for owner, group, and others.

$ ls -l /etc/shadow
-rw-r----- 1 root shadow 1520 Jul 24 09:14 /etc/shadow

$ id
uid=1000(alex) gid=1000(alex) groups=1000(alex),27(sudo),999(docker)

Reading permission strings: rwxr-xr-- breaks down as: owner has read/write/execute, group has read/execute, others have read-only. Numerically this is 754 (4=read, 2=write, 1=execute, summed per triad).

grep -i 'password' config.php          # case-insensitive match
grep -rn 'API_KEY' /var/www/           # recursive, show line numbers
grep -E '[0-9]{1,3}(\.[0-9]{1,3}){3}' file   # extended regex, e.g. IPs

find / -perm -4000 -type f 2>/dev/null   # SUID binaries — classic privesc hunt
find / -writable -type f 2>/dev/null     # world-writable files
find / -name '*.conf' -mtime -7          # config files modified in last 7 days

sed 's/foo/bar/g' file.txt   # replace all 'foo' with 'bar'
sed -n '10,20p' file.txt     # print lines 10-20

awk -F: '{print $1}' /etc/passwd          # print first field (usernames)
awk '$3 > 1000 {print $1}' /etc/passwd    # users with UID over 1000

#!/bin/bash
# Simple host sweep for live IPs on a /24
for i in $(seq 1 254); do
  ip="192.168.1.$i"
  ping -c1 -W1 "$ip" &>/dev/null && echo "$ip is up"
done

name="world"
if [ -f /etc/passwd ]; then echo "file exists"; fi
while read -r line; do echo "$line"; done < list.txt
for f in *.txt; do echo "$f"; done

A curated set of tools that cover the vast majority of external and internal recon during an authorized engagement or CTF.

Roughly in the order most operators run it once they land a low-privilege shell in a lab or authorized engagement.

• Who am I / what can I run: id, sudo -l
• Kernel & OS version: uname -a, cat /etc/os-release — check against known kernel exploits
• SUID/SGID binaries: find / -perm -4000 -o -perm -2000 2>/dev/null — cross-reference against GTFOBins
• Writable /etc/passwd or /etc/shadow: ls -la /etc/passwd /etc/shadow
• Cron jobs: cat /etc/crontab, check scripts they call for writable paths
• Capabilities: getcap -r / 2>/dev/null — binaries with elevated capabilities
• Sensitive files: SSH keys in home directories, .bash_history, config files with embedded credentials
• Kernel/container escape indicators: Docker/LXD group membership, exposed Docker socket
• Automated sweep: run LinPEAS or linux-smart-enumeration in the lab to catch what manual checks miss

Understanding what a system logs is essential both for blue-team detection engineering and for writing an accurate, defensible pentest report.

Everything in this document is meant to be practiced against systems you control.

• Attacker box: Kali Linux or Parrot OS in a VM (VirtualBox / VMware / UTM).
• Vulnerable targets: Metasploitable2/3, DVWA, OWASP Juice Shop, or downloadable VulnHub images.
• Guided practice: HackTheBox and TryHackMe for structured, legal target environments.
• Isolated networking: keep the lab on a host-only or NAT network, never bridged to your real LAN.
• Snapshot everything: take VM snapshots before risky changes so you can roll back instantly.

• GTFOBins (gtfobins.github.io) — SUID/sudo binary abuse reference for privesc.
• HackTricks (book.hacktricks.xyz) — deep enumeration and exploitation methodology wiki.
• Explainshell (explainshell.com) — paste any shell command to see it broken down flag by flag.
• OverTheWire: Bandit — a free wargame that teaches core Linux command-line skills interactively.
• Linux Journey (linuxjourney.com) — structured beginner-to-intermediate Linux fundamentals.