25 Essential Linux Commands for Ethical Hackers and Defenders
A practical terminal guide covering process auditing, network inspection, permission auditing, and incident triage in Linux.
1. Why Linux Command-Line Proficiency is Non-Negotiable
Whether you are conducting an authorized red team engagement, auditing Docker containers, or hunting threats in a Security Operations Center (SOC), the Linux terminal is your primary workspace.
GUIs are rarely available on enterprise production servers. Being able to swiftly navigate directories, audit permissions, monitor processes, and dissect log files directly from an SSH shell is the hallmark of a capable cybersecurity practitioner.
2. Process & System Auditing Commands
When inspecting a potentially compromised host, identifying what binaries are executing, who spawned them, and how much CPU they consume is step one.
The 'ps' command lists current running processes. Using 'ps aux' provides a complete snapshot of all running processes across all users.
Combine 'ps' with 'grep' to filter for suspicious daemon names, or use 'top' and 'htop' for dynamic, real-time performance inspection.
# Find processes running as root with full command-line arguments
ps -u root -f
# Inspect tree hierarchy to see parent-child process relationships
pstree -p3. Network Inspection & Open Socket Analysis
Attackers often establish reverse shells or listen on high-numbered ports. Defenders must quickly determine which sockets are listening and which remote IP addresses are established.
While legacy tutorials teach 'netstat', the modern Linux standard is 'ss' (Socket Statistics). It interfaces directly with kernel networking code, delivering faster results.
# Display all listening TCP (-t) and UDP (-u) sockets with numeric ports (-n) and process IDs (-p)
ss -tulnp
# Inspect active established connections to detect outbound beaconing
ss -tup state established4. Auditing SUID and File Permissions
In Linux, files have read, write, and execute permissions divided among Owner, Group, and Others. A special permission bit called SUID (Set User ID) allows a program to execute with the privileges of the file owner (often root).
Misconfigured SUID binaries are one of the most common vectors for local privilege escalation in Capture The Flag challenges and real-world system audits.
# Search the entire filesystem for binaries with the SUID bit set
find / -perm -u=s -type f 2>/dev/null5. Log Triage in /var/log
When investigating authentication failures or brute-force attacks, Debian/Ubuntu logs are stored in '/var/log/auth.log', while RHEL/CentOS stores them in '/var/log/secure'.
Using 'journalctl -u ssh -n 50' allows you to quickly view recent SSH connection attempts, helping you spot credential stuffing attempts in seconds.