Linux Basics for Hackers: File System & Navigation - Complete Guide 2026

# Linux Basics for Hackers: File System & Navigation - Complete Guide 2026

## Introduction

Understanding the Linux file system is fundamental for any aspiring penetration tester or ethical hacker. Unlike Windows with its drive letters (C:, D:), Linux uses a hierarchical tree structure where everything stems from a single root directory. This comprehensive guide will teach you how to navigate, understand, and leverage the Linux file system for penetration testing operations.

Whether you're just starting with [Kali Linux installation](/tutorials/how-to-install-kali-linux-in-virtualbox-complete-2026-guide) or preparing for professional [penetration testing engagements](/articles/pentest-methodology-the-complete-guide-for-2026), mastering file system navigation is your gateway to becoming proficient in Linux-based security operations.

## Understanding the Linux File System Hierarchy

### The Root Directory: Everything Starts at `/`

In Linux, **everything is a file** - this philosophical approach extends to devices, sockets, and directories. The entire file system begins at the root directory denoted by a single forward slash `/`. Unlike Windows, there are no separate drive letters; all storage devices and partitions are mounted as branches of this single tree.

```bash
# View the root directory
ls /
```

This simple command reveals the top-level directories that form the foundation of your Linux system.

### Critical Directories Every Pentester Must Know

#### 1. `/root` - The Superuser's Home

The `/root` directory is the home directory for the root user (system administrator with ultimate privileges). This is distinct from the root directory `/`.

```bash
# Access root's home (requires root privileges)
sudo ls /root

# Check your current user's home
echo $HOME
```

**Why it matters for pentesters:**
- Post-exploitation, gaining root access means accessing `/root`
- Configuration files, command history, and SSH keys may store sensitive data
- Root's `.bash_history` often reveals administrative commands

#### 2. `/home` - User Home Directories

Every regular user gets a dedicated directory under `/home/username`. This is where personal files, configurations, and user-specific data reside.

```bash
# List all user home directories
ls -la /home/

# View your home directory
cd ~
pwd
```

**Pentesting significance:**
- User credentials and SSH keys (`~/.ssh/`)
- Browser history and saved passwords
- Development configurations that may contain API keys
- Application-specific credential storage

#### 3. `/etc` - Configuration Central

The `/etc` directory contains system-wide configuration files. This is one of the most critical directories for security professionals.

```bash
# View configuration files
ls /etc/

# Critical files for pentesters
cat /etc/passwd # User account information
sudo cat /etc/shadow # Password hashes (requires root)
cat /etc/hosts # Hostname to IP mappings
cat /etc/resolv.conf # DNS configuration
```

**Essential `/etc` files for ethical hackers:**

- **`/etc/passwd`**: Contains user account information (usernames, UIDs, home directories)
- **`/etc/shadow`**: Stores encrypted password hashes (accessible only by root)
- **`/etc/group`**: Group membership information
- **`/etc/sudoers`**: Sudo privileges configuration
- **`/etc/crontab`**: Scheduled task definitions (useful for persistence)
- **`/etc/ssh/sshd_config`**: SSH server configuration
- **`/etc/network/interfaces`**: Network interface configuration (Debian-based)

#### 4. `/var` - Variable Data

The `/var` directory holds variable data that changes during system operation - logs, databases, mail spools, and temporary files.

```bash
# Navigate to logs
cd /var/log/
ls -lh

# View recent authentication attempts
sudo tail -f /var/log/auth.log # Debian/Ubuntu
sudo tail -f /var/log/secure # CentOS/RHEL
```

**Key subdirectories for pentesters:**

- **`/var/log/`**: System and application logs
- `auth.log` / `secure`: Authentication attempts
- `syslog` / `messages`: General system messages
- `apache2/` or `nginx/`: Web server logs
- `mysql/`: Database logs
- **`/var/www/`**: Web server document root (often)
- **`/var/spool/cron/`**: User cron jobs
- **`/var/backups/`**: System backups (may contain sensitive data)

#### 5. `/tmp` - Temporary File Storage

The `/tmp` directory is world-writable and used for temporary file storage. Files here may be deleted on reboot.

```bash
# Create a temporary file
echo "test" > /tmp/myfile.txt

# Check permissions
ls -ld /tmp
# Output: drwxrwxrwt (note the 't' - sticky bit)
```

**Security implications:**
- Commonly used for exploit payloads and temporary scripts
- World-writable but protected by the sticky bit (users can only delete their own files)
- May be mounted with `noexec` to prevent execution (check with `mount | grep tmp`)
- Alternative: `/dev/shm` (RAM-based temporary storage, often not monitored)

#### 6. `/usr` - User Binaries and Data

Despite its name, `/usr` (Unix System Resources) contains user-accessible applications, libraries, and documentation - not user data.

```bash
# Common usr subdirectories
ls /usr/bin/ # User commands
ls /usr/sbin/ # System administration commands
ls /usr/local/ # Locally installed software
ls /usr/share/ # Architecture-independent data
```

**Structure:**
- `/usr/bin/`: Essential command binaries (ls, cat, grep)
- `/usr/sbin/`: System binaries (usually require root)
- `/usr/local/bin/`: Locally compiled/installed programs
- `/usr/share/`: Documentation, icons, man pages

#### 7. `/opt` - Optional/Third-Party Software

The `/opt` directory houses add-on application packages - particularly third-party and larger software suites.

```bash
# View installed optional software
ls /opt/

# Common in Kali Linux
ls /opt/ | grep -E "metasploit|burp|maltego"
```

**Pentesting tools often found here:**
- Commercial tools (Burp Suite Pro, Maltego)
- Manual installations of frameworks (sometimes Metasploit)
- Custom compiled tools

#### 8. `/bin` and `/sbin` - Essential Binaries

- **`/bin`**: Contains essential command-line utilities needed for system booting and repair (bash, ls, cat, cp, mv)
- **`/sbin`**: System binaries for system administration (fsck, reboot, iptables, ifconfig)

```bash
# View essential commands
ls /bin/ | head -20

# View system administration tools
ls /sbin/ | head -20
```

**Note:** Modern distributions often symlink `/bin` to `/usr/bin` and `/sbin` to `/usr/sbin` for consistency.

#### 9. `/dev` - Device Files

Linux represents hardware devices as files in `/dev`. This includes hard drives, terminals, USB devices, and pseudo-devices.

```bash
# List device files
ls /dev/

# View disk devices
ls /dev/sd* # SATA/SCSI disks
ls /dev/nvme* # NVMe drives

# Special devices
cat /dev/urandom | head -c 16 # Random data generator
echo "test" > /dev/null # Null device (discards data)
```

**Important devices:**
- `/dev/sda`, `/dev/sdb`: Hard drives
- `/dev/tty`: Terminal devices
- `/dev/null`: Discards all written data
- `/dev/zero`: Provides null bytes
- `/dev/random`, `/dev/urandom`: Random number generators

#### 10. `/proc` and `/sys` - Virtual File Systems

These aren't real file systems but interfaces to kernel data structures.

```bash
# View running processes
ls /proc/ # Each number is a process ID (PID)

# System information
cat /proc/cpuinfo # CPU details
cat /proc/meminfo # Memory information
cat /proc/version # Kernel version
cat /proc/net/tcp # Active TCP connections

# Hardware information
ls /sys/class/net/ # Network interfaces
```

**Pentesting use cases:**
- Enumerate running processes: `ls /proc/ | grep -E '^[0-9]+$'`
- Check network connections without netstat: `cat /proc/net/tcp`
- Find process details: `cat /proc/<PID>/cmdline`

## Navigating the File System Like a Pro

### Essential Navigation Commands

#### `pwd` - Print Working Directory

Always know where you are in the file system.

```bash
pwd
# Output: /home/kali
```

#### `cd` - Change Directory

Master the art of moving around the file system.

```bash
# Navigate to a specific directory
cd /etc/

# Go to home directory (three ways)
cd ~
cd $HOME
cd

# Move up one directory
cd ..

# Move up two directories
cd ../..

# Return to previous directory
cd -

# Navigate using absolute path
cd /var/log/apache2/

# Navigate using relative path (from /var/log)
cd apache2/
```

**Pro tips:**
```bash
# Use Tab completion to save time
cd /etc/net[TAB] # Completes to /etc/network/

# Navigate to a directory with spaces (rare in Linux)
cd "My Folder"
cd My\ Folder
```

#### `ls` - List Directory Contents

The most frequently used command - see what's in a directory.

```bash
# Basic listing
ls

# Long format (detailed)
ls -l

# Show hidden files (starting with .)
ls -a

# Long format with hidden files
ls -la

# Human-readable file sizes
ls -lh

# Sort by modification time (newest first)
ls -lt

# Recursive listing
ls -R

# Color-coded output (usually default)
ls --color=auto

# List only directories
ls -d */

# Show inode numbers
ls -i
```

**Real-world pentesting examples:**

```bash
# Find recently modified files (potential backdoors)
ls -lat /var/www/html/ | head -20

# Search for SUID binaries (privilege escalation)
ls -la /usr/bin/ | grep '^...s'

# List files with specific permissions
ls -l /etc/ | grep '^-rw-rw-rw-' # World-writable files
```

### Understanding Paths: Absolute vs Relative

#### Absolute Paths

An absolute path starts from the root directory `/` and specifies the complete location.

```bash
# Always starts with /
cd /home/kali/Documents/
cat /etc/passwd
ls /var/log/
```

**When to use:**
- Scripting (ensures consistency)
- When current location is unclear
- Referencing system directories

#### Relative Paths

A relative path is based on your current working directory.

```bash
# Assuming you're in /home/kali
cd Documents/ # Goes to /home/kali/Documents/
cd ../Downloads/ # Goes to /home/kali/Downloads/
cat ../../etc/passwd # Accesses /etc/passwd
```

**Special path symbols:**
- `.` : Current directory
- `..` : Parent directory
- `~` : Home directory
- `-` : Previous directory

```bash
# Execute a script in current directory
./script.sh

# Copy file to current directory
cp /tmp/file.txt .

# Move up and navigate
cd ../../var/log/
```

## Understanding Linux File Types

Linux supports several file types beyond regular files and directories.

### File Type Identification

```bash
# Check file type
file /etc/passwd
file /bin/bash
file /dev/sda

# Visual identification with ls -l
ls -l /
```

**File type indicators (first character in `ls -l`):**

| Symbol | Type | Description | Example |
|--------|------|-------------|----------|
| `-` | Regular file | Standard files (text, binary, etc.) | `-rw-r--r-- file.txt` |
| `d` | Directory | Folders containing other files | `drwxr-xr-x home/` |
| `l` | Symbolic link | Shortcut to another file | `lrwxrwxrwx link -> target` |
| `c` | Character device | Serial devices (keyboard, mouse) | `crw-rw---- /dev/tty1` |
| `b` | Block device | Storage devices (hard drives) | `brw-rw---- /dev/sda1` |
| `s` | Socket | Inter-process communication | `srwxrwxrwx /tmp/mysql.sock` |
| `p` | Named pipe (FIFO) | Inter-process communication | `prw-r--r-- mypipe` |

### Working with Symbolic Links

Symbolic links (symlinks) are pointers to other files or directories.

```bash
# Create a symbolic link
ln -s /path/to/original /path/to/link

# Example: Create a shortcut
ln -s /var/www/html ~/webroot

# View symlink target
readlink ~/webroot
ls -l ~/webroot

# Follow symlink
cd -P ~/webroot # Goes to actual directory
```

**Pentesting context:**
- Symlink attacks for privilege escalation
- Following symlinks in web directories for directory traversal
- Identifying configuration file locations

### Hidden Files in Linux

Files and directories starting with `.` are hidden by default.

```bash
# View hidden files
ls -a

# Common hidden configuration files
ls -la ~/ | grep '^\.' # View all dotfiles in home

# Important hidden files/directories
cat ~/.bashrc # Bash configuration
cat ~/.bash_history # Command history
ls ~/.ssh/ # SSH keys and config
cat ~/.mysql_history # MySQL command history
ls -la ~/.config/ # Application configurations
```

**Security implications:**
- **`.bash_history`**: Contains all typed commands (may include passwords)
- **`.ssh/`**: Private keys for authentication
- **`.aws/`, `.config/gcloud/`**: Cloud provider credentials
- **Backdoor hidden files**: Attackers often use hidden files/directories

## Finding Files in Linux

Locating files quickly is crucial for penetration testing and system administration.

### The `find` Command - The Swiss Army Knife

`find` is the most powerful file search tool, with extensive filtering options.

```bash
# Basic syntax
find /path/ -name "filename"

# Find by name (case-insensitive)
find /home/ -iname "*.txt"

# Find directories
find / -type d -name "config"

# Find regular files
find / -type f -name "passwd"

# Find files modified in last 7 days
find /var/log/ -mtime -7

# Find files modified more than 30 days ago
find /tmp/ -mtime +30

# Find files by size
find / -size +100M # Larger than 100MB
find / -size -1M # Smaller than 1MB

# Find files by permissions
find / -perm 777 # Exactly 777
find / -perm -4000 # SUID bit set
find / -perm /u+s # SUID (alternative syntax)

# Find files owned by user
find / -user root
find / -group www-data

# Execute commands on found files
find . -name "*.log" -exec cat {} \;
find / -perm -4000 -exec ls -l {} \;

# Combine multiple criteria
find /var/www/ -type f -name "*.php" -mtime -7
```

**Pentesting use cases:**

```bash
# Find SUID/SGID binaries (privilege escalation)
find / -perm -4000 -type f 2>/dev/null
find / -perm -2000 -type f 2>/dev/null

# Find world-writable files
find / -perm -002 -type f 2>/dev/null

# Find world-writable directories
find / -perm -002 -type d 2>/dev/null

# Find files containing passwords (in filename)
find / -name "*password*" 2>/dev/null
find / -name "*credential*" 2>/dev/null

# Find recently modified files (post-exploitation)
find /etc/ -type f -mmin -60 # Modified in last hour

# Find files by specific user
find / -user www-data 2>/dev/null

# Find writable directories
find / -type d -writable 2>/dev/null

# Find configuration files
find /etc/ -name "*.conf" 2>/dev/null

# Find SSH keys
find / -name "id_rsa" 2>/dev/null
find / -name "authorized_keys" 2>/dev/null
```

**Note:** `2>/dev/null` redirects error messages (like "Permission denied") to discard them.

### The `locate` Command - Lightning Fast Search

`locate` uses a pre-built database for instant searches (must be updated periodically).

```bash
# Update the database (run as root)
sudo updatedb

# Basic search
locate password
locate php.ini

# Case-insensitive search
locate -i PASSWORD

# Count results
locate -c "*.conf"

# Show only existing files (check if file still exists)
locate -e password.txt

# Limit results
locate -l 10 "*.log"
```

**Advantages:**
- Extremely fast (searches database, not filesystem)
- No need to specify starting directory

**Disadvantages:**
- Requires updated database (`updatedb`)
- Database may be outdated (typically updated daily)
- Shows all matches system-wide (can be overwhelming)

### The `which` Command - Find Command Executables

`which` locates executable binaries in your PATH.

```bash
# Find command location
which python
which nmap
which bash

# Check if command exists
which metasploit

# Show all matches in PATH
which -a python
```

**Use cases:**
- Verify which version of a tool will be executed
- Check if a tool is installed
- Identify command location for scripting

### The `whereis` Command - Comprehensive Binary Search

`whereis` locates binary, source, and man page files.

```bash
# Find binary, source, and man pages
whereis bash
# Output: bash: /bin/bash /etc/bash.bashrc /usr/share/man/man1/bash.1.gz

whereis nmap
whereis python3

# Only binary
whereis -b nmap

# Only manual pages
whereis -m nmap

# Only source code
whereis -s nmap
```

### Comparison Table: Find Tools

| Command | Speed | Database | Use Case |
|---------|-------|----------|----------|
| `find` | Slow | No (real-time) | Complex searches, recent files, permissions |
| `locate` | Very fast | Yes (updatedb) | Quick filename searches |
| `which` | Fast | No (PATH only) | Find executables in PATH |
| `whereis` | Fast | Yes (specific paths) | Find binaries, sources, man pages |

## Directory Structure for Penetration Testers

### Critical Files and Directories

#### User Enumeration

```bash
# List all users
cat /etc/passwd
cut -d: -f1 /etc/passwd # Extract usernames only

# Real users (UID >= 1000)
awk -F: '$3 >= 1000 {print $1}' /etc/passwd

# Users with login shells
grep -v '/nologin\|/false' /etc/passwd

# View groups
cat /etc/group

# Sudoers configuration
sudo cat /etc/sudoers
sudo ls /etc/sudoers.d/
```

#### Password Hashes

```bash
# Password hashes (requires root)
sudo cat /etc/shadow

# Format: username:$id$salt$hash:lastchange:min:max:warn:inactive:expire
# Hash types:
# $1$ = MD5
# $2a$ or $2y$ = Blowfish
# $5$ = SHA-256
# $6$ = SHA-512

# Extract for cracking
sudo unshadow /etc/passwd /etc/shadow > hashes.txt
```

#### System Logs

```bash
# Authentication logs
sudo tail -f /var/log/auth.log # Debian/Ubuntu
sudo tail -f /var/log/secure # RHEL/CentOS

# System logs
sudo tail -f /var/log/syslog # Debian/Ubuntu
sudo tail -f /var/log/messages # RHEL/CentOS

# Web server logs
sudo tail -f /var/log/apache2/access.log
sudo tail -f /var/log/apache2/error.log
sudo tail -f /var/log/nginx/access.log

# Failed login attempts
sudo grep "Failed password" /var/log/auth.log

# Successful sudo commands
sudo grep "COMMAND" /var/log/auth.log
```

#### Network Configuration

```bash
# Network interfaces
cat /etc/network/interfaces # Debian/Ubuntu
cat /etc/sysconfig/network-scripts/ifcfg-eth0 # RHEL/CentOS

# DNS resolution
cat /etc/resolv.conf

# Host mappings
cat /etc/hosts

# Active connections (proc interface)
cat /proc/net/tcp
cat /proc/net/udp
```

#### Scheduled Tasks

```bash
# System-wide cron jobs
cat /etc/crontab
ls /etc/cron.d/
ls /etc/cron.daily/
ls /etc/cron.hourly/
ls /etc/cron.weekly/
ls /etc/cron.monthly/

# User cron jobs
sudo crontab -l -u root
crontab -l
sudo ls /var/spool/cron/crontabs/

# Systemd timers (modern alternative)
systemctl list-timers
```

#### Service Configurations

```bash
# SSH configuration
cat /etc/ssh/sshd_config

# Apache configuration
ls /etc/apache2/
cat /etc/apache2/apache2.conf
ls /etc/apache2/sites-enabled/

# Nginx configuration
ls /etc/nginx/
cat /etc/nginx/nginx.conf
ls /etc/nginx/sites-enabled/

# MySQL/MariaDB
cat /etc/mysql/my.cnf
ls /etc/mysql/conf.d/

# Database connection strings
find /var/www/ -name "*.php" -exec grep -i "mysql_connect\|mysqli" {} +
```

### Web Application Directories

```bash
# Default web roots
/var/www/html/ # Apache/Nginx default
/usr/share/nginx/html/ # Nginx alternative
/var/www/ # General web directory

# Check web server user
ps aux | grep -E 'apache|nginx|httpd'
# Common: www-data, apache, nginx

# Find writable web directories
find /var/www/ -type d -writable 2>/dev/null

# Find upload directories
find /var/www/ -type d -name "upload*" -o -name "files"

# Find configuration files with credentials
find /var/www/ -name "config.php" -o -name "wp-config.php" -o -name ".env"
```

### Sensitive File Hunting

```bash
# SSH keys
find / -name "id_rsa" 2>/dev/null
find / -name "id_dsa" 2>/dev/null
find / -name "authorized_keys" 2>/dev/null

# Configuration files with passwords
find / -name "*.conf" -exec grep -i "password" {} + 2>/dev/null
find /home/ -name ".bash_history" 2>/dev/null

# Database files
find / -name "*.db" 2>/dev/null
find / -name "*.sqlite" 2>/dev/null

# Backup files
find / -name "*.bak" 2>/dev/null
find / -name "*.backup" 2>/dev/null
find /var/backups/ -type f 2>/dev/null

# Cloud credentials
find / -name "credentials" 2>/dev/null
find / -name "*.pem" 2>/dev/null
find /home/ -name ".aws" 2>/dev/null
```

## Practical Exercises for Skill Building

### Exercise 1: File System Exploration

**Objective:** Familiarize yourself with the Linux directory structure.

1. Navigate to the root directory and list all directories:
```bash
cd /
ls -l
```

2. Explore each major directory using `cd` and `ls`:
```bash
cd /etc
ls -lh
cd /var/log
ls -lh
cd /usr/bin
ls | wc -l # Count binaries
```

3. Find your way back home using different methods:
```bash
cd ~
cd
cd $HOME
```

### Exercise 2: Finding Files

**Objective:** Practice using `find`, `locate`, and `which`.

1. Find all `.conf` files in `/etc`:
```bash
find /etc/ -name "*.conf" 2>/dev/null
```

2. Locate all Python executables:
```bash
which -a python python3
whereis python3
```

3. Find recently modified files in `/tmp`:
```bash
find /tmp/ -type f -mmin -60
```

4. Search for SUID binaries:
```bash
find / -perm -4000 -type f 2>/dev/null | tee suid-binaries.txt
```

### Exercise 3: User and System Enumeration

**Objective:** Practice gathering system information.

1. List all users on the system:
```bash
cat /etc/passwd | cut -d: -f1 | sort
```

2. Find users with UID 0 (root privileges):
```bash
awk -F: '$3 == 0 {print $1}' /etc/passwd
```

3. Check for users with empty passwords:
```bash
sudo awk -F: '$2 == "" {print $1}' /etc/shadow
```

4. List all running services:
```bash
systemctl list-units --type=service --state=running
```

### Exercise 4: Log Analysis

**Objective:** Learn to navigate and analyze system logs.

1. View the last 20 authentication attempts:
```bash
sudo tail -20 /var/log/auth.log
```

2. Find failed SSH login attempts:
```bash
sudo grep "Failed password" /var/log/auth.log | tail -10
```

3. Count failed login attempts by IP:
```bash
sudo grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn
```

4. Monitor logs in real-time:
```bash
sudo tail -f /var/log/syslog
```

### Exercise 5: Web Directory Investigation

**Objective:** Practice web application file system analysis.

1. Find the web root:
```bash
ls -la /var/www/html/
```

2. Search for PHP files:
```bash
find /var/www/ -name "*.php" 2>/dev/null
```

3. Look for configuration files:
```bash
find /var/www/ -name "config*.php" -o -name ".env" -o -name "wp-config.php" 2>/dev/null
```

4. Identify upload directories:
```bash
find /var/www/ -type d \( -name "upload*" -o -name "files" -o -name "media" \) 2>/dev/null
```

### Exercise 6: Creating a Custom File System Map

**Objective:** Document a target system's layout.

Create a script to map the file system:

```bash
#!/bin/bash
# filesystem-mapper.sh

echo "[+] File System Reconnaissance"
echo "================================"
echo ""

echo "[*] System Information:"
uname -a
echo ""

echo "[*] Disk Usage:"
df -h
echo ""

echo "[*] Users (UID >= 1000):"
awk -F: '$3 >= 1000 {print $1}' /etc/passwd
echo ""

echo "[*] SUID Binaries:"
find / -perm -4000 -type f 2>/dev/null
echo ""

echo "[*] World-Writable Directories:"
find / -type d -perm -002 2>/dev/null | head -20
echo ""

echo "[*] Cron Jobs:"
cat /etc/crontab 2>/dev/null
ls -la /etc/cron.* 2>/dev/null
echo ""

echo "[+] Reconnaissance Complete"
```

Run it:
```bash
chmod +x filesystem-mapper.sh
./filesystem-mapper.sh > system-map.txt
```

## Integration with Penetration Testing Workflow

### Phase 1: Initial Foothold

After gaining initial access to a system:

```bash
# Verify access and location
pwd
whoami
id

# Quick system enumeration
uname -a
cat /etc/os-release

# Check user privileges
sudo -l

# Identify current directory permissions
ls -la
```

### Phase 2: Privilege Escalation Research

```bash
# Search for SUID binaries
find / -perm -4000 -type f 2>/dev/null

# Check for writable /etc/passwd
ls -la /etc/passwd

# Look for sudo misconfigurations
sudo -l
cat /etc/sudoers 2>/dev/null

# Check for interesting cronjobs
cat /etc/crontab
ls -la /etc/cron.*

# Find writable scripts or binaries
find / -writable -type f 2>/dev/null | grep -v proc
```

### Phase 3: Credential Harvesting

```bash
# Command history
cat ~/.bash_history
cat ~/.mysql_history
cat ~/.psql_history

# Configuration files
find /home/ -name "*.conf" 2>/dev/null
find /var/www/ -name "config*.php" 2>/dev/null

# SSH keys
find / -name "id_rsa" 2>/dev/null
cat ~/.ssh/id_rsa
cat ~/.ssh/authorized_keys

# Database credentials
find / -name "*.sql" 2>/dev/null
grep -r "password" /var/www/ 2>/dev/null | grep -i db
```

### Phase 4: Persistence and Lateral Movement

```bash
# Identify other users and systems
cat /etc/passwd
cat /etc/hosts
cat ~/.ssh/known_hosts

# Network configuration
ifconfig
ip addr
cat /etc/network/interfaces

# Active connections
netstat -antp
ss -antp
cat /proc/net/tcp

# Installed software
ls /opt/
ls /usr/local/bin/
dpkg -l # Debian/Ubuntu
rpm -qa # RHEL/CentOS
```

## Best Practices and Tips

### 1. Always Know Your Location

```bash
# Add to your prompt (edit ~/.bashrc)
PS1='\u@\h:\w\$ '
# Shows: username@hostname:/current/path$
```

### 2. Use Tab Completion

Press `Tab` to autocomplete file and directory names. Press `Tab` twice to see all possibilities.

### 3. Navigate Efficiently

```bash
# Use cd - to toggle between directories
cd /etc/
cd /var/log/
cd - # Back to /etc/
cd - # Back to /var/log/

# Use pushd and popd for directory stack
pushd /etc/
pushd /var/log/
pushd /tmp/
dirs # View stack
popd # Return to previous
```

### 4. Redirect Errors

When searching the entire filesystem, suppress "Permission denied" errors:

```bash
find / -name "config.php" 2>/dev/null
```

### 5. Combine Commands with Pipes

```bash
# Find and count
find /etc/ -name "*.conf" 2>/dev/null | wc -l

# Find and display
find / -perm -4000 2>/dev/null | xargs ls -lh

# Grep through multiple files
find /var/www/ -name "*.php" -exec grep -l "mysql_connect" {} \;
```

### 6. Document Everything

Save command output for reporting:

```bash
find / -perm -4000 2>/dev/null | tee suid-report.txt
uname -a >> system-info.txt
cat /etc/passwd >> system-info.txt
```

### 7. Learn to Read Permissions

```bash
# ls -l output format:
# -rwxr-xr-x 1 owner group size date name
# ↑ ↑ ↑ ↑ ↑ ↑
# │ │ │ │ │ └─ File type
# │ │ │ │ └─── Owner permissions (rwx = 7)
# │ │ │ └───── Group permissions (r-x = 5)
# │ │ └─────── Others permissions (r-x = 5)
# │ └───────── Number of hard links
# └─────────── File type (- = file, d = directory, l = link)

# Permission calculation:
# r (read) = 4
# w (write) = 2
# x (execute) = 1
# rwx = 7, rw- = 6, r-x = 5, r-- = 4
```

### 8. Use Aliases for Efficiency

Add to `~/.bashrc`:

```bash
alias ll='ls -lah'
alias ..='cd ..'
alias ...='cd ../..'
alias h='history'
alias ports='netstat -antp'
alias fs='find / -name'
```

Reload:
```bash
source ~/.bashrc
```

## Common Mistakes to Avoid

### 1. Confusing `/root` and `/`

- `/` is the root directory (top of the file system)
- `/root` is the home directory of the root user

### 2. Forgetting Error Redirection

```bash
# Bad - cluttered output
find / -name config.php

# Good - clean output
find / -name config.php 2>/dev/null
```

### 3. Not Using Quotes for Filenames with Spaces

```bash
# Wrong
cat my file.txt # Tries to cat "my" and "file.txt"

# Right
cat "my file.txt"
cat my\ file.txt
```

### 4. Overwriting Important Files

```bash
# Very dangerous - redirects to the same file
grep pattern file.txt > file.txt # Empties file.txt!

# Safe - use a different output file
grep pattern file.txt > output.txt
```

### 5. Not Checking Current Directory Before Using `.`

```bash
# Dangerous if you're in the wrong location
rm -rf .

# Always verify first
pwd
ls -la
```

## Frequently Asked Questions (FAQ)

### Q1: What's the difference between `/bin`, `/usr/bin`, `/sbin`, and `/usr/sbin`?

**A:** These directories traditionally served different purposes:

- **`/bin`**: Essential command-line utilities needed for single-user mode and system repair (bash, ls, cat, cp, rm)
- **`/sbin`**: Essential system administration commands needed for boot and recovery (fsck, init, reboot, iptables)
- **`/usr/bin`**: User commands and applications for normal system operation (less critical than /bin)
- **`/usr/sbin`**: System administration tools for regular multi-user operation

The distinction was based on:
- **Essential vs. non-essential**: `/bin` and `/sbin` contain critical tools needed if `/usr` isn't mounted
- **User vs. admin**: `bin` directories for regular users, `sbin` for system administrators

**Modern systems:** Many distributions now symlink `/bin` → `/usr/bin` and `/sbin` → `/usr/sbin` because separate `/usr` partitions are less common. Kali Linux follows this unified approach.

**For pentesters:** Search both locations when hunting for binaries:
```bash
find /bin /sbin /usr/bin /usr/sbin -name "python*"
```

### Q2: How do I find files modified by an attacker after a specific date?

**A:** Use `find` with time-based options:

```bash
# Files modified in the last N days
find / -type f -mtime -7 # Last 7 days

# Files modified in the last N minutes
find / -type f -mmin -60 # Last 60 minutes

# Files modified after a specific date
touch -t 202601150000 /tmp/timestamp # Jan 15, 2026 00:00
find / -newer /tmp/timestamp 2>/dev/null

# More precise: files modified between dates
touch -t 202601150000 /tmp/start
touch -t 202601200000 /tmp/end
find / -newer /tmp/start ! -newer /tmp/end 2>/dev/null

# Focus on critical directories
find /etc /var/www /home -type f -mtime -1

# Sort by modification time
find /var/www/ -type f -mtime -7 -exec ls -lt {} + | head -20
```

**Incident response tip:** Attackers often modify `/etc/passwd`, `/etc/shadow`, web shell files, or cron jobs. Check these first:
```bash
ls -la /etc/passwd /etc/shadow /etc/crontab
find /var/www/ -name "*.php" -mtime -1
```

### Q3: What are SUID binaries, and why are they important for pentesting?

**A:** **SUID** (Set User ID) is a special permission that allows a program to run with the privileges of its owner (usually root), regardless of who executes it.

**How it works:**
```bash
# Example: ping needs root to create raw sockets
ls -l /bin/ping
# -rwsr-xr-x ... /bin/ping
# ↑
# s = SUID bit
```

When you run `ping`, it temporarily executes with root privileges even though you're a regular user.

**Why pentesters care:**
1. **Privilege escalation**: Misconfigured or vulnerable SUID binaries can be exploited to gain root access
2. **GTFOBins**: Many SUID binaries can be abused (e.g., `nmap --interactive` in old versions)

**Find SUID binaries:**
```bash
# Find all SUID files
find / -perm -4000 -type f 2>/dev/null

# Find SGID files (similar concept, group ID)
find / -perm -2000 -type f 2>/dev/null

# Find both
find / -perm -4000 -o -perm -2000 2>/dev/null

# Detailed listing
find / -perm -4000 -type f -exec ls -lh {} \; 2>/dev/null

# Common exploitable SUID binaries to check:
# - find, nmap (old versions), vim, bash, more, less, nano, cp, mv
```

**Exploitation example (if `find` has SUID):**
```bash
find /home -exec /bin/sh -p \; # Spawns root shell
```

**Resources:**
- [GTFOBins](https://gtfobins.github.io/) - Database of SUID-exploitable binaries
- Check [andraxpentester.in's privilege escalation guides](/articles/pentest-methodology-the-complete-guide-for-2026) for detailed exploitation techniques

### Q4: How do I safely practice these commands without breaking my system?

**A:** Follow these safety practices:

**1. Use a Virtual Machine:**
```bash
# Practice in Kali Linux VM or any disposable Linux instance
# Quick setup: https://andraxpentester.in/tutorials/how-to-install-kali-linux-in-virtualbox-complete-2026-guide
```

**2. Create Snapshots:**
- Before practicing, take a VM snapshot
- If you break something, revert to the snapshot

**3. Use a Test Directory:**
```bash
# Create a safe playground
mkdir -p ~/practice-area
cd ~/practice-area

# Create test files and directories
mkdir -p test/{dir1,dir2,dir3}
touch test/file{1..10}.txt
echo "Sample content" > test/file1.txt

# Practice here instead of system directories
find ~/practice-area -name "*.txt"
ls -la ~/practice-area/test/
```

**4. Use Read-Only Commands First:**

Safe commands (won't modify anything):
- `ls`, `cat`, `less`, `more`
- `find` (without `-exec` or `-delete`)
- `pwd`, `cd`, `which`, `whereis`
- `grep`, `head`, `tail`

Potentially dangerous commands:
- `rm`, `mv`, `chmod`, `chown`
- `find` with `-exec` or `-delete`
- `>` (redirect/overwrite)
- `dd`, `mkfs`

**5. Use `-i` Interactive Mode:**
```bash
# Prompt before each removal
rm -i file.txt

# Prompt before overwriting
mv -i source.txt dest.txt
cp -i file1 file2
```

**6. Double-Check Before Destructive Operations:**
```bash
# Bad - immediate deletion
rm -rf /path/to/dir

# Good - verify first
ls /path/to/dir
du -sh /path/to/dir
# Then, if correct:
rm -rf /path/to/dir
```

**7. Add Safety Aliases to `~/.bashrc`:**
```bash
alias rm='rm -i'
alias mv='mv -i'
alias cp='cp -i'
```

**8. Practice on Purpose-Built Systems:**
- [OverTheWire Bandit](http://overthewire.org/wargames/bandit/) - Linux command practice wargame
- [HackTheBox](https://www.hackthebox.eu/) - Vulnerable VMs for pentesting practice
- Local Docker containers

### Q5: What's the best way to remember all these directory locations and commands?

**A:** Use these memory techniques and reference materials:

**1. Create a Visual Cheat Sheet:**

Save this as `~/filesystem-cheatsheet.txt`:
```
Linux File System Quick Reference
==================================
/ Root (everything starts here)
/root Root user's home
/home User home directories
/etc Configuration files
/var Variable data (logs, databases)
/tmp Temporary files (world-writable)
/usr User programs and data
/opt Optional/third-party software
/bin Essential commands
/sbin System admin commands
/dev Device files
/proc Process information (virtual)
/var/log System logs

Navigation:
cd Change directory
cd ~ Go home
cd .. Up one level
cd - Previous directory
pwd Print working directory

Listing:
ls -la Long format, all files
ls -lh Human-readable sizes
ls -lt Sort by time

Finding:
find / -name "file" Find by name
find / -type f -mtime -7 Modified last 7 days
find / -perm -4000 SUID binaries
locate file Fast search (uses DB)
which command Find in PATH
```

**2. Practice Regularly:**
```bash
# Daily practice routine (5 minutes)
cd /
ls -la
pwd
cd /etc && ls -lh | head
cd /var/log && ls -lh
find /home -name "*.txt" 2>/dev/null | head -5
cd ~
```

**3. Use Mnemonics:**
- **`/etc`** = "**Et Cetera**" (configuration files)
- **`/var`** = "**Variable**" (changing data like logs)
- **`/tmp`** = "**Temporary**"
- **`/usr`** = "**Unix System Resources**" (not "user"!)
- **`/opt`** = "**Optional**" packages
- **`/bin`** = "**Binaries**" (executables)

**4. Create Path Association Stories:**
"When I log in as root (`/root`), I check the system logs (`/var/log`) and review configuration files (`/etc`) before making changes. Then I check my tools in `/opt` and look at web applications in `/var/www`."

**5. Use Command History:**
```bash
# Search command history
history | grep find
Ctrl + R # Then type search term (interactive)

# Save useful commands
echo "find / -perm -4000 2>/dev/null" >> ~/useful-commands.txt
```

**6. Build Muscle Memory:**

Set yourself these weekly challenges:
- **Week 1:** Navigate to 10 different directories daily
- **Week 2:** Use `find` with 3 different criteria each day
- **Week 3:** Analyze logs and configuration files
- **Week 4:** Complete a full system enumeration simulation

**7. Keep Reference Cards:**

Print and keep near your workstation:
- [Linux File System Hierarchy Chart](https://www.linux.org/docs/)
- [Essential Linux Commands Poster](https://cheat.sh/)
- Create custom quick-reference cards for your most-used commands

**8. Use Spaced Repetition:**

Use flashcard apps (Anki, Quizlet) with questions like:
- Q: Where are password hashes stored? A: `/etc/shadow`
- Q: Command to find SUID binaries? A: `find / -perm -4000 2>/dev/null`
- Q: Where are system logs typically located? A: `/var/log/`

**9. Integrate Into Practice:**

Whenever you work through pentesting tutorials (like those on [andraxpentester.in](/tutorials/kali-linux-setup-essential-post-installation-steps-2026)), actively use these commands rather than copy-pasting.

**10. Bookmark Quality References:**
- [Official Kali Linux Documentation](https://www.kali.org/docs/)
- [Linux.org Learning Resources](https://www.linux.org/)
- [andraxpentester.in Tutorials](/tutorials/kali-linux-configuration-essential-settings-updates-2026-guide)

## Next Steps in Your Learning Journey

Now that you understand the Linux file system, you're ready to:

1. **Master File Permissions:** Learn about read, write, execute permissions, SUID, SGID, and sticky bits
2. **Learn File Manipulation:** Commands like `cat`, `grep`, `sed`, `awk` for working with file contents
3. **Process Management:** Understanding running processes, `/proc` filesystem, and process manipulation
4. **Network Configuration:** Deep dive into network interfaces, routing, and firewall rules
5. **Privilege Escalation:** Exploit file system misconfigurations for security testing

Continue your [Kali Linux learning path](/articles/what-is-penetration-testing-complete-guide-for-beginners-2026) with our tutorial series, and practice these concepts in real-world scenarios. Remember, consistent hands-on practice is the key to mastery.

## Conclusion

The Linux file system hierarchy is the foundation of effective system administration and penetration testing. By understanding the purpose of each directory, mastering navigation commands, and knowing where to look for critical files, you've taken a significant step toward becoming a proficient ethical hacker.

Key takeaways:
- Everything starts at the root directory `/`
- Each directory has a specific purpose (configuration, logs, binaries, etc.)
- Navigation commands (`cd`, `ls`, `pwd`) are your primary tools
- The `find` command is essential for comprehensive file searches
- Understanding file types and permissions is crucial
- Critical pentesting files are in `/etc`, `/var/log`, `/home`, and application-specific directories

Remember: knowledge alone isn't enough. Set up your [Kali Linux environment](/tutorials/how-to-install-kali-linux-in-virtualbox-complete-2026-guide), practice these commands daily, and apply them in realistic scenarios. The file system is your roadmap - learn to read it fluently, and you'll navigate any Linux system with confidence.

Happy hacking, and stay ethical!

---

**About the Author:** Syed Abrar (Andrax Pentester) is a cybersecurity professional specializing in penetration testing and ethical hacking education. Follow more tutorials and security research at [andraxpentester.in](https://andraxpentester.in).

**Disclaimer:** The techniques described in this tutorial are for educational purposes and authorized security testing only. Always obtain proper authorization before testing any system you don't own. Unauthorized access to computer systems is illegal.