Post cover image

October 28, 2026

10 Linux Commands Every Cybersecurity Beginner Should Know

Learn Linux from the ground up with practical commands, examples, and safe exercises for your cybersecurity journey.

By Satyam Kumar

9 min read

If you want to learn cybersecurity, ethical hacking, or penetration testing, there is one skill worth developing early: being comfortable with the Linux command line.

Linux is widely used in servers, cloud infrastructure, development environments, and security tools. Many cybersecurity workflows involve navigating directories, inspecting files, checking permissions, understanding running processes, and analysing system logs.

But when beginners open a terminal for the first time, it can feel confusing. Commands look unfamiliar, options seem complicated, and a small mistake can produce an error that makes no sense.

The solution is not to memorize hundreds of commands.

Start with a few essential commands, understand what they do, and practise them in a safe environment. Once you know the basics, learning more advanced tools becomes much easier.

In this guide, we will explore 10 useful Linux commands for cybersecurity beginners, complete with examples, expected outputs, and practical exercises.

Before You Begin: Open a Linux Terminal

You can practise these commands on Ubuntu, Kali Linux, or another Linux distribution.

If your main computer runs Windows, you can use a Linux virtual machine or Windows Subsystem for Linux (WSL). A virtual machine is particularly useful when you want an isolated environment for cybersecurity labs.

Open your terminal and try the following command:

echo "My cybersecurity learning journey starts here!"

Expected output:

My cybersecurity learning journey starts here!

If you see the message, your terminal is ready.

For the exercises in this article, use your own files and system. Avoid running unfamiliar commands with administrator privileges.

1. pwd — Find Your Current Location

The pwd command stands for print working directory.

It displays the full path of the directory you are currently working in.

Why does this matter in cybersecurity?

Before examining files, changing permissions, or running a script, you should know where you are. Understanding your current directory helps prevent mistakes when working with files and system resources.

Example

pwd

Possible output:

/home/student

Your output may differ depending on your username and system configuration.

This means the current directory is /home/student.

Try it yourself

  1. Open your terminal.
  2. Run pwd.
  3. Record the path displayed.
  4. Later, navigate to another directory and run pwd again.

What you learn: How Linux represents file locations and how to verify your current working directory.

2. ls — List Files and Directories

The ls command displays the contents of a directory.

It is one of the commands you will use most frequently while learning Linux.

Basic example

ls

Possible output:

Documents  Downloads  Pictures  Projects

The names displayed depend on the files and directories present on your system.

Useful variations

Display detailed file information:

ls -l

Display hidden files as well:

ls -a

Combine both options:

ls -la

A detailed listing may look like this:

-rw-r--r-- 1 student student 128 Oct 20 10:15 notes.txt
drwxr-xr-x 2 student student  64 Oct 20 10:20 Projects

The listing contains information about permissions, ownership, file size, modification time, and file name.

In the example, -rw-r--r-- represents the permissions of notes.txt, while the initial d in drwxr-xr-x indicates that Projects is a directory.

Cybersecurity connection

When investigating a system you are authorized to examine, listing files can help you understand directory contents, locate configuration files, and notice unexpected entries.

However, a filename alone does not establish whether a file is malicious.

Try it yourself

Run:

ls
ls -la

Compare the results. Identify at least one difference between the two outputs.

3. cd — Navigate Between Directories

The cd command means change directory.

It allows you to move between folders without opening a graphical file manager.

Examples

Move into a directory:

cd Documents

Move one level up:

cd ..

Return to your home directory:

cd ~

Return to the previous working directory:

cd -

You can combine cd with pwd to verify where you have arrived.

Practical exercise

Run these commands one at a time:

pwd
cd ..
pwd
cd ~
pwd

Observe how the displayed directory changes.

Cybersecurity connection: Security tools, scripts, and configuration files often expect you to work from a particular directory. Learning navigation reduces errors and helps you understand where your files are stored.

4. mkdir — Create a Practice Directory

The mkdir command creates directories.

Instead of practising directly in important system folders, create a dedicated workspace for your exercises.

Example

mkdir cyber-practice

This creates a directory named cyber-practice in your current location, provided a directory with that name does not already exist.

Verify it:

ls

You should see:

cyber-practice

Now create a subdirectory:

mkdir cyber-practice/linux-basics

This works if cyber-practice already exists.

Alternatively, create both levels in one command:

mkdir -p cyber-practice/linux-basics

The -p option creates missing parent directories as needed.

Why this is useful

A dedicated practice directory helps you organize scripts, sample logs, notes, and lab results.

It also encourages a good security habit: separating experimental work from important personal or system files.

5. cat — Read Text Files

The cat command can display the contents of text files.

It is useful for reading simple configuration files, notes, and sample logs.

Create a sample file

First, move into your practice directory:

cd ~/cyber-practice

Create a file containing sample events:

cat > sample.log <<'EOF'
10:00 INFO Application started
10:02 WARNING Login attempt failed
10:03 INFO User logged in
10:05 ERROR Connection timeout
EOF

This creates sample.log and writes four lines into it.

The EOF markers indicate the beginning and end of the text being written.

Now display the file:

cat sample.log

Expected output:

10:00 INFO Application started
10:02 WARNING Login attempt failed
10:03 INFO User logged in
10:05 ERROR Connection timeout

Cybersecurity connection

Security analysts frequently examine logs to understand events, identify errors, and investigate suspicious activity.

Our sample is fictional, but it illustrates how log entries can record events over time.

Be careful when handling real logs: they may contain usernames, IP addresses, session identifiers, or other sensitive information.

Try it yourself

Add two more lines to the sample file using a text editor, then run cat sample.log again.

Observe how the contents change.

6. grep — Search for Specific Text

The grep command searches text for patterns.

It becomes particularly useful when a file contains hundreds or thousands of lines and you want to locate relevant entries.

Example

Search for lines containing ERROR:

grep "ERROR" sample.log

Expected output:

10:05 ERROR Connection timeout

Search for failed login events:

grep "Login attempt failed" sample.log

Expected output:

10:02 WARNING Login attempt failed

Search without distinguishing between uppercase and lowercase letters:

grep -i "error" sample.log

Search with line numbers:

grep -n "INFO" sample.log

Expected output:

1:10:00 INFO Application started
3:10:03 INFO User logged in

Cybersecurity connection

grep can help filter logs for failed authentication attempts, error messages, and other events worth investigating.

However, finding a failed login does not automatically mean an attack occurred. Analysts must consider the surrounding evidence and context.

Try it yourself

Add this line to sample.log:

10:07 WARNING Login attempt failed

Then run:

grep "Login attempt failed" sample.log

You should now see two matching lines.

7. find — Locate Files and Directories

The find command searches for files and directories based on criteria such as their names, types, or modification times.

It is more flexible than simply listing the contents of one directory.

Example

Find all files in your practice directory:

find ~/cyber-practice -type f

Possible output:

/home/student/cyber-practice/sample.log

Your path and results may differ.

Find files with a .log extension:

find ~/cyber-practice -type f -name "*.log"

Find directories instead of files:

find ~/cyber-practice -type d

Understanding the options

  • find starts a search.
  • ~/cyber-practice specifies where to search.
  • -type f limits results to regular files.
  • -type d limits results to directories.
  • -name "*.log" matches names ending in .log.

The quotation marks prevent the shell from expanding the wildcard before find receives it.

Cybersecurity connection

When examining an authorized system, find can help locate configuration files, scripts, and other relevant files.

Start by searching a directory you control rather than searching the entire filesystem. This makes results easier to understand and avoids unnecessary access errors.

8. chmod — Change File Permissions

Linux uses permissions to control who can read, write, or execute files.

The chmod command changes these permissions.

This is an important concept in system security because unnecessarily broad permissions can expose files or allow unauthorized modification.

Example: Make a script executable

Create a small script:

cd ~/cyber-practice
printf '#!/bin/sh\necho "Practice script executed"\n' > hello.sh

Inspect its permissions:

ls -l hello.sh

Possible output:

-rw-r--r-- 1 student student 50 Oct 20 10:30 hello.sh

Your file size and timestamp may differ.

Now make it executable by its owner:

chmod u+x hello.sh

Check again:

ls -l hello.sh

Possible output:

-rwxr--r-- 1 student student 50 Oct 20 10:30 hello.sh

The x permission has been added for the owner.

Run the script:

./hello.sh

Expected output:

Practice script executed

Understanding permission symbols

  • r means read.
  • w means write.
  • x means execute.
  • u refers to the file owner.
  • g refers to the group.
  • o refers to others.

You may also encounter numeric permissions such as 644 and 755. Learn how these values work before changing permissions on important files.

Important: Avoid using chmod 777 as a routine solution to permission problems. It grants read, write, and execute permissions to everyone and can introduce unnecessary security risks.

9. ps — Inspect Running Processes

A process is an instance of a running program.

The ps command displays information about processes.

Understanding processes is useful when learning system administration, troubleshooting applications, and investigating system activity.

Example

Display processes associated with your current terminal:

ps

Possible output:

PID TTY          TIME CMD
   2451 pts/0    00:00:00 bash
   2518 pts/0    00:00:00 ps

Process IDs, terminal names, and displayed commands will vary.

To display a broader list of processes:

ps aux

This shows processes across the system, subject to the information available to your user.

To search the output for a particular application:

ps aux | grep "[b]ash"

The | character is called a pipe. It sends the output of one command to another command.

The expression [b]ash matches the text bash while avoiding the usual self-match from the literal grep "[b]ash" command line.

Cybersecurity connection

Process inspection helps you understand what is running on a system. During an investigation, analysts may examine unexpected processes, resource consumption, and relationships between applications.

But a process name alone cannot prove that a program is safe or malicious. Additional evidence may be necessary.

Try it yourself

Run:

ps aux

Identify the process ID (PID), username, and command columns.

Then run:

ps aux | grep "[b]ash"

Compare the results.

10. ip — Inspect Network Configuration

The ip command displays and manages network interfaces, routes, and related networking information.

For beginners, its inspection features are a useful starting point.

Display network interfaces

ip addr

The output may contain entries such as:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 ...
    inet 127.0.0.1/8 scope host lo

The lo interface is the loopback interface. The address 127.0.0.1 refers to the local computer.

Other interfaces may show addresses assigned to your Ethernet or Wi-Fi connection.

Display the routing table

ip route

A possible output might look like this:

default via 192.168.1.1 dev wlan0
192.168.1.0/24 dev wlan0 proto kernel scope link

This is an illustrative example. Your system may use different addresses, interface names, and routing entries.

The first line describes a default route through a gateway. The second describes a directly connected network.

Cybersecurity connection

Understanding interfaces, IP addresses, and routes is essential for network troubleshooting and security monitoring.

Before using network-scanning tools, learn how to identify your own lab network and determine which systems you are authorized to test.

Safety reminder: Inspecting your network configuration is different from scanning or testing other devices. Obtain explicit permission before testing systems that you do not own.

Bonus: Combine Commands to Work More Efficiently

The real power of the Linux command line comes from combining simple commands.

For example:

grep "WARNING" sample.log | wc -l

This searches the log for lines containing WARNING and counts the matching lines.

If your sample file contains the original warning entry and the two failed-login warnings added during the exercises, the result will be:

3

Another useful example:

find ~/cyber-practice -type f -name "*.log"

This locates log files within your practice workspace.

Learn to understand each part of a command before combining several operations.

A 30-Minute Practice Challenge

Now that you have explored these commands, complete the following challenge without copying the examples directly.

Task 1: Create a directory called linux-security-lab.

Task 2: Create a file called events.log containing at least five fictional application events.

Task 3: Display the current directory and list its contents.

Task 4: Search the file for lines containing WARNING.

Task 5: Find all .log files inside your practice directory.

Task 6: Create a simple shell script and give its owner execute permission.

Task 7: Display your network interfaces and inspect your running processes.

Task 8: Write a short explanation of what each command helped you learn.

These exercises use your own files and ordinary system-inspection commands. They do not require attacking, scanning, or accessing another person's system.

If you can complete these tasks and explain the results, you have taken a useful first step toward Linux proficiency.

What Should You Learn After These 10 Commands?

Once you are comfortable with these commands, continue with:

  1. File permissions and ownership in greater depth.
  2. Users, groups, and sudo.
  3. Text editing with nano or another editor.
  4. Shell scripting with Bash.
  5. Package management and software updates.
  6. System logs and the journalctl command.
  7. Networking fundamentals and packet analysis.
  8. Safe, guided cybersecurity labs.

You can practise Linux fundamentals with OverTheWire: Bandit, a hands-on learning resource designed to introduce command-line concepts through challenges.

For web security, the PortSwigger Web Security Academy offers free lessons and interactive labs.

For broader beginner cybersecurity training, explore TryHackMe and check the current availability of its free learning content.

Final Thoughts

You do not need to memorize every Linux command to begin learning cybersecurity.

Start with the basics. Understand your directories, inspect files, search text, learn permissions, examine processes, and understand your network configuration.

Then repeat the exercises until the commands feel familiar.

The goal is not simply to make a terminal produce output. The goal is to understand what that output means and how it helps you solve a problem.

Learn the fundamentals first. Practise consistently. Use security tools responsibly.

Your cybersecurity journey becomes much easier when you understand the system underneath the tools.

Which Linux command did you find most useful? Share your answer in the comments, and follow for more beginner-friendly articles on Linux, cybersecurity, ethical hacking, and AI.