Linux Command Line Cheat Sheet

Navigation & Files

• List files with details ls -lah
• Find files by name find / -name "config.php" 2>/dev/null
• Find by perms/type find / -type f -perm -4000 2>/dev/null (SUID)
• Change directory / create / copy / move / remove cd, mkdir -p, cp -r, mv, rm -rf
• Show file type file ./foo
• Read files cat file / less file / tail -f file
• grep inside files grep -R "password" /var/www/ 2>/dev/null
• grep with context/color grep -rinE "api[_-]?key|secret" -C 2 /path

Users & Permissions

• Current user id; whoami
• Sudo as other user sudo -u www-data command
• File perms chmod 755 file / owner chown user:group file
• SUID binaries (privilege esc potential) find / -perm -u=s -type f 2>/dev/null
• Sudo rights sudo -l
• Switch user su - username

Processes & Services

• See running processes ps aux
• Filter a process ps aux | grep <name>
• Kill kill -9 <pid> / pkill pkill -f <name>
• Systemd unit status systemctl status <svc> / start/stop/enable
• Port listening (who’s bound) ss -tlnp (netstat -tlnp)
• Which process uses a port ss -tlnp | grep :80, lsof -i :80

Networking

• DNS lookup dig hostname, nslookup hostname
• Ping / route ping, ip a, ip route, traceroute
• Curl basics curl -s http://host/, curl -I, curl -X POST -d "a=1", curl -k https
• Download wget http://host/file
• SCP copy scp file user@host:/path, scp -r dir user@host:/path
• SSH ssh user@host, ssh -i key user@host, ssh -L 8080:target:80 user@host
• Port forward with ssh ssh -ND 9050 user@host (socks proxy via proxychains)

Compression & Archives

• ZIP zip -r out.zip dir/ / unzip file.zip
• TAR tar -czf out.tar.gz dir/ / tar -xzf file.tar.gz
• 7z 7z x file.7z

Text Processing (one-liners)

• Sorted unique list sort | uniq -c | sort -nr
• Cut fields cut -d: -f1 /etc/passwd
• Stream edit sed 's/old/new/g' file
• awk field print awk -F: '{print $1}' /etc/passwd
• Count lines wc -l file

Environment & Shell

• Add to PATH export PATH=$PATH:/opt/tools
• History history, clear history -c
• Jobs: background &, jobs, fg, bg
• Cron crontab -e, view crontab -l, system /etc/crontab
• Startup scripts: /etc/rc.local, /etc/profile.d/

Enumeration shortcuts for pentesting

• Writable world paths find / -type f -writable 2>/dev/null
• Kernel version uname -a / cat /etc/os-release
• Installed security tools which nmap sqlmap hydra john gobuster ffuf
• Environment secrets env | grep -iE "key|pass|token|secret"

Misc Robustness

• Exit on fail / dry run
• History expansion !!, !$
• Run in the background (nohup cmd &)
• Alias shortcuts alias ll='ls -lah'