Linux Basics for Hackers: File System & Navigation - Complete Guide 2026

Introduction

Understanding the Linux file system is fundamental for any aspiring penetration tester or ethical hacker. Unlike Windows with its drive letters (C:, D:), Linux uses a hierarchical tree structure where everything stems from a single root directory. This comprehensive guide will teach you how to navigate, understand, and leverage the Linux file system for penetration testing operations.

Whether you're just starting with Kali Linux installation or preparing for professional penetration testing engagements, mastering file system navigation is your gateway to becoming proficient in Linux-based security operations.

Understanding the Linux File System Hierarchy

The Root Directory: Everything Starts at /

In Linux, everything is a file - this philosophical approach extends to devices, sockets, and directories. The entire file system begins at the root directory denoted by a single forward slash /. Unlike Windows, there are no separate drive letters; all storage devices and partitions are mounted as branches of this single tree.

# View the root directory
ls /

This simple command reveals the top-level directories that form the foundation of your Linux system.

Critical Directories Every Pentester Must Know

1. /root - The Superuser's Home

The /root directory is the home directory for the root user (system administrator with ultimate privileges). This is distinct from the root directory /.

# Access root's home (requires root privileges)
sudo ls /root

# Check your current user's home
echo $HOME

Why it matters for pentesters:

• Post-exploitation, gaining root access means accessing /root
• Configuration files, command history, and SSH keys may store sensitive data
• Root's .bash_history often reveals administrative commands

2. /home - User Home Directories

Every regular user gets a dedicated directory under /home/username. This is where personal files, configurations, and user-specific data reside.

# List all user home directories
ls -la /home/

# View your home directory
cd ~
pwd

Pentesting significance:

• User credentials and SSH keys (~/.ssh/)
• Browser history and saved passwords
• Development configurations that may contain API keys
• Application-specific credential storage

3. /etc - Configuration Central

The /etc directory contains system-wide configuration files. This is one of the most critical directories for security professionals.

# View configuration files
ls /etc/

# Critical files for pentesters
cat /etc/passwd    # User account information
sudo cat /etc/shadow    # Password hashes (requires root)
cat /etc/hosts     # Hostname to IP mappings
cat /etc/resolv.conf    # DNS configuration

Essential /etc files for ethical hackers:

• /etc/passwd: Contains user account information (usernames, UIDs, home directories)
• /etc/shadow: Stores encrypted password hashes (accessible only by root)
• /etc/group: Group membership information
• /etc/sudoers: Sudo privileges configuration
• /etc/crontab: Scheduled task definitions (useful for persistence)
• /etc/ssh/sshd_config: SSH server configuration
• /etc/network/interfaces: Network interface configuration (Debian-based)

4. /var - Variable Data

The /var directory holds variable data that changes during system operation - logs, databases, mail spools, and temporary files.

# Navigate to logs
cd /var/log/
ls -lh

# View recent authentication attempts
sudo tail -f /var/log/auth.log    # Debian/Ubuntu
sudo tail -f /var/log/secure      # CentOS/RHEL

Key subdirectories for pentesters:

• /var/log/: System and application logs
  • auth.log / secure: Authentication attempts
  • syslog / messages: General system messages
  • apache2/ or nginx/: Web server logs
  • mysql/: Database logs
• /var/www/: Web server document root (often)
• /var/spool/cron/: User cron jobs
• /var/backups/: System backups (may contain sensitive data)

5. /tmp - Temporary File Storage

The /tmp directory is world-writable and used for temporary file storage. Files here may be deleted on reboot.

# Create a temporary file
echo "test" > /tmp/myfile.txt

# Check permissions
ls -ld /tmp
# Output: drwxrwxrwt (note the 't' - sticky bit)

Security implications:

• Commonly used for exploit payloads and temporary scripts
• World-writable but protected by the sticky bit (users can only delete their own files)
• May be mounted with noexec to prevent execution (check with mount | grep tmp)
• Alternative: /dev/shm (RAM-based temporary storage, often not monitored)

6. /usr - User Binaries and Data

Despite its name, /usr (Unix System Resources) contains user-accessible applications, libraries, and documentation - not user data.

# Common usr subdirectories
ls /usr/bin/      # User commands
ls /usr/sbin/     # System administration commands
ls /usr/local/    # Locally installed software
ls /usr/share/    # Architecture-independent data

Structure:

• /usr/bin/: Essential command binaries (ls, cat, grep)
• /usr/sbin/: System binaries (usually require root)
• /usr/local/bin/: Locally compiled/installed programs
• /usr/share/: Documentation, icons, man pages

7. /opt - Optional/Third-Party Software

The /opt directory houses add-on application packages - particularly third-party and larger software suites.

# View installed optional software
ls /opt/

# Common in Kali Linux
ls /opt/ | grep -E "metasploit|burp|maltego"

Pentesting tools often found here:

• Commercial tools (Burp Suite Pro, Maltego)
• Manual installations of frameworks (sometimes Metasploit)
• Custom compiled tools

8. /bin and /sbin - Essential Binaries

• /bin: Contains essential command-line utilities needed for system booting and repair (bash, ls, cat, cp, mv)
• /sbin: System binaries for system administration (fsck, reboot, iptables, ifconfig)

# View essential commands
ls /bin/ | head -20

# View system administration tools
ls /sbin/ | head -20

Note: Modern distributions often symlink /bin to /usr/bin and /sbin to /usr/sbin for consistency.

9. /dev - Device Files

Linux represents hardware devices as files in /dev. This includes hard drives, terminals, USB devices, and pseudo-devices.

# List device files
ls /dev/

# View disk devices
ls /dev/sd*    # SATA/SCSI disks
ls /dev/nvme*  # NVMe drives

# Special devices
cat /dev/urandom | head -c 16    # Random data generator
echo "test" > /dev/null          # Null device (discards data)

Important devices:

• /dev/sda, /dev/sdb: Hard drives
• /dev/tty: Terminal devices
• /dev/null: Discards all written data
• /dev/zero: Provides null bytes
• /dev/random, /dev/urandom: Random number generators

10. /proc and /sys - Virtual File Systems

These aren't real file systems but interfaces to kernel data structures.

# View running processes
ls /proc/    # Each number is a process ID (PID)

# System information
cat /proc/cpuinfo     # CPU details
cat /proc/meminfo     # Memory information
cat /proc/version     # Kernel version
cat /proc/net/tcp     # Active TCP connections

# Hardware information
ls /sys/class/net/    # Network interfaces

Pentesting use cases:

• Enumerate running processes: ls /proc/ | grep -E '^[0-9]+$'
• Check network connections without netstat: cat /proc/net/tcp
• Find process details: cat /proc/<PID>/cmdline

Navigating the File System Like a Pro

Essential Navigation Commands

pwd - Print Working Directory

Always know where you are in the file system.

pwd
# Output: /home/kali

cd - Change Directory

Master the art of moving around the file system.

# Navigate to a specific directory
cd /etc/

# Go to home directory (three ways)
cd ~
cd $HOME
cd

# Move up one directory
cd ..

# Move up two directories
cd ../..

# Return to previous directory
cd -

# Navigate using absolute path
cd /var/log/apache2/

# Navigate using relative path (from /var/log)
cd apache2/

Pro tips:

# Use Tab completion to save time
cd /etc/net[TAB]    # Completes to /etc/network/

# Navigate to a directory with spaces (rare in Linux)
cd "My Folder"
cd My\ Folder

ls - List Directory Contents

The most frequently used command - see what's in a directory.

# Basic listing
ls

# Long format (detailed)
ls -l

# Show hidden files (starting with .)
ls -a

# Long format with hidden files
ls -la

# Human-readable file sizes
ls -lh

# Sort by modification time (newest first)
ls -lt

# Recursive listing
ls -R

# Color-coded output (usually default)
ls --color=auto

# List only directories
ls -d */

# Show inode numbers
ls -i

Real-world pentesting examples:

# Find recently modified files (potential backdoors)
ls -lat /var/www/html/ | head -20

# Search for SUID binaries (privilege escalation)
ls -la /usr/bin/ | grep '^...s'

# List files with specific permissions
ls -l /etc/ | grep '^-rw-rw-rw-'    # World-writable files

Understanding Paths: Absolute vs Relative

Absolute Paths

An absolute path starts from the root directory / and specifies the complete location.

# Always starts with /
cd /home/kali/Documents/
cat /etc/passwd
ls /var/log/

When to use:

• Scripting (ensures consistency)
• When current location is unclear
• Referencing system directories

Relative Paths

A relative path is based on your current working directory.

# Assuming you're in /home/kali
cd Documents/        # Goes to /home/kali/Documents/
cd ../Downloads/     # Goes to /home/kali/Downloads/
cat ../../etc/passwd # Accesses /etc/passwd

Special path symbols:

• . : Current directory
• .. : Parent directory
• ~ : Home directory
• - : Previous directory

# Execute a script in current directory
./script.sh

# Copy file to current directory
cp /tmp/file.txt .

# Move up and navigate
cd ../../var/log/

Understanding Linux File Types

Linux supports several file types beyond regular files and directories.

File Type Identification

# Check file type
file /etc/passwd
file /bin/bash
file /dev/sda

# Visual identification with ls -l
ls -l /

File type indicators (first character in ls -l):

Working with Symbolic Links

Symbolic links (symlinks) are pointers to other files or directories.

# Create a symbolic link
ln -s /path/to/original /path/to/link

# Example: Create a shortcut
ln -s /var/www/html ~/webroot

# View symlink target
readlink ~/webroot
ls -l ~/webroot

# Follow symlink
cd -P ~/webroot    # Goes to actual directory

Pentesting context:

• Symlink attacks for privilege escalation
• Following symlinks in web directories for directory traversal
• Identifying configuration file locations

Hidden Files in Linux

Files and directories starting with . are hidden by default.

# View hidden files
ls -a

# Common hidden configuration files
ls -la ~/ | grep '^\.'    # View all dotfiles in home

# Important hidden files/directories
cat ~/.bashrc           # Bash configuration
cat ~/.bash_history     # Command history
ls ~/.ssh/              # SSH keys and config
cat ~/.mysql_history    # MySQL command history
ls -la ~/.config/       # Application configurations

Security implications:

• .bash_history: Contains all typed commands (may include passwords)
• .ssh/: Private keys for authentication
• .aws/, .config/gcloud/: Cloud provider credentials
• Backdoor hidden files: Attackers often use hidden files/directories

Finding Files in Linux

Locating files quickly is crucial for penetration testing and system administration.

The find Command - The Swiss Army Knife

find is the most powerful file search tool, with extensive filtering options.

# Basic syntax
find /path/ -name "filename"

# Find by name (case-insensitive)
find /home/ -iname "*.txt"

# Find directories
find / -type d -name "config"

# Find regular files
find / -type f -name "passwd"

# Find files modified in last 7 days
find /var/log/ -mtime -7

# Find files modified more than 30 days ago
find /tmp/ -mtime +30

# Find files by size
find / -size +100M          # Larger than 100MB
find / -size -1M            # Smaller than 1MB

# Find files by permissions
find / -perm 777            # Exactly 777
find / -perm -4000          # SUID bit set
find / -perm /u+s           # SUID (alternative syntax)

# Find files owned by user
find / -user root
find / -group www-data

# Execute commands on found files
find . -name "*.log" -exec cat {} \;
find / -perm -4000 -exec ls -l {} \;

# Combine multiple criteria
find /var/www/ -type f -name "*.php" -mtime -7

Pentesting use cases:

# Find SUID/SGID binaries (privilege escalation)
find / -perm -4000 -type f 2>/dev/null
find / -perm -2000 -type f 2>/dev/null

# Find world-writable files
find / -perm -002 -type f 2>/dev/null

# Find world-writable directories
find / -perm -002 -type d 2>/dev/null

# Find files containing passwords (in filename)
find / -name "*password*" 2>/dev/null
find / -name "*credential*" 2>/dev/null

# Find recently modified files (post-exploitation)
find /etc/ -type f -mmin -60    # Modified in last hour

# Find files by specific user
find / -user www-data 2>/dev/null

# Find writable directories
find / -type d -writable 2>/dev/null

# Find configuration files
find /etc/ -name "*.conf" 2>/dev/null

# Find SSH keys
find / -name "id_rsa" 2>/dev/null
find / -name "authorized_keys" 2>/dev/null

Note: 2>/dev/null redirects error messages (like "Permission denied") to discard them.

The locate Command - Lightning Fast Search

locate uses a pre-built database for instant searches (must be updated periodically).

# Update the database (run as root)
sudo updatedb

# Basic search
locate password
locate php.ini

# Case-insensitive search
locate -i PASSWORD

# Count results
locate -c "*.conf"

# Show only existing files (check if file still exists)
locate -e password.txt

# Limit results
locate -l 10 "*.log"

Advantages:

• Extremely fast (searches database, not filesystem)
• No need to specify starting directory

Disadvantages:

• Requires updated database (updatedb)
• Database may be outdated (typically updated daily)
• Shows all matches system-wide (can be overwhelming)

The which Command - Find Command Executables

which locates executable binaries in your PATH.

# Find command location
which python
which nmap
which bash

# Check if command exists
which metasploit

# Show all matches in PATH
which -a python

Use cases:

• Verify which version of a tool will be executed
• Check if a tool is installed
• Identify command location for scripting

The whereis Command - Comprehensive Binary Search

whereis locates binary, source, and man page files.

# Find binary, source, and man pages
whereis bash
# Output: bash: /bin/bash /etc/bash.bashrc /usr/share/man/man1/bash.1.gz

whereis nmap
whereis python3

# Only binary
whereis -b nmap

# Only manual pages
whereis -m nmap

# Only source code
whereis -s nmap

Comparison Table: Find Tools

Directory Structure for Penetration Testers

Critical Files and Directories

User Enumeration

# List all users
cat /etc/passwd
cut -d: -f1 /etc/passwd    # Extract usernames only

# Real users (UID >= 1000)
awk -F: '$3 >= 1000 {print $1}' /etc/passwd

# Users with login shells
grep -v '/nologin\|/false' /etc/passwd

# View groups
cat /etc/group

# Sudoers configuration
sudo cat /etc/sudoers
sudo ls /etc/sudoers.d/

Password Hashes

# Password hashes (requires root)
sudo cat /etc/shadow

# Format: username:$id$salt$hash:lastchange:min:max:warn:inactive:expire
# Hash types:
#   $1$ = MD5
#   $2a$ or $2y$ = Blowfish
#   $5$ = SHA-256
#   $6$ = SHA-512

# Extract for cracking
sudo unshadow /etc/passwd /etc/shadow > hashes.txt

System Logs

# Authentication logs
sudo tail -f /var/log/auth.log      # Debian/Ubuntu
sudo tail -f /var/log/secure        # RHEL/CentOS

# System logs
sudo tail -f /var/log/syslog        # Debian/Ubuntu
sudo tail -f /var/log/messages      # RHEL/CentOS

# Web server logs
sudo tail -f /var/log/apache2/access.log
sudo tail -f /var/log/apache2/error.log
sudo tail -f /var/log/nginx/access.log

# Failed login attempts
sudo grep "Failed password" /var/log/auth.log

# Successful sudo commands
sudo grep "COMMAND" /var/log/auth.log

Network Configuration

# Network interfaces
cat /etc/network/interfaces         # Debian/Ubuntu
cat /etc/sysconfig/network-scripts/ifcfg-eth0  # RHEL/CentOS

# DNS resolution
cat /etc/resolv.conf

# Host mappings
cat /etc/hosts

# Active connections (proc interface)
cat /proc/net/tcp
cat /proc/net/udp

Scheduled Tasks

# System-wide cron jobs
cat /etc/crontab
ls /etc/cron.d/
ls /etc/cron.daily/
ls /etc/cron.hourly/
ls /etc/cron.weekly/
ls /etc/cron.monthly/

# User cron jobs
sudo crontab -l -u root
crontab -l
sudo ls /var/spool/cron/crontabs/

# Systemd timers (modern alternative)
systemctl list-timers

Service Configurations

# SSH configuration
cat /etc/ssh/sshd_config

# Apache configuration
ls /etc/apache2/
cat /etc/apache2/apache2.conf
ls /etc/apache2/sites-enabled/

# Nginx configuration
ls /etc/nginx/
cat /etc/nginx/nginx.conf
ls /etc/nginx/sites-enabled/

# MySQL/MariaDB
cat /etc/mysql/my.cnf
ls /etc/mysql/conf.d/

# Database connection strings
find /var/www/ -name "*.php" -exec grep -i "mysql_connect\|mysqli" {} +

Web Application Directories

# Default web roots
/var/www/html/              # Apache/Nginx default
/usr/share/nginx/html/      # Nginx alternative
/var/www/                   # General web directory

# Check web server user
ps aux | grep -E 'apache|nginx|httpd'
# Common: www-data, apache, nginx

# Find writable web directories
find /var/www/ -type d -writable 2>/dev/null

# Find upload directories
find /var/www/ -type d -name "upload*" -o -name "files"

# Find configuration files with credentials
find /var/www/ -name "config.php" -o -name "wp-config.php" -o -name ".env"

Sensitive File Hunting

# SSH keys
find / -name "id_rsa" 2>/dev/null
find / -name "id_dsa" 2>/dev/null
find / -name "authorized_keys" 2>/dev/null

# Configuration files with passwords
find / -name "*.conf" -exec grep -i "password" {} + 2>/dev/null
find /home/ -name ".bash_history" 2>/dev/null

# Database files
find / -name "*.db" 2>/dev/null
find / -name "*.sqlite" 2>/dev/null

# Backup files
find / -name "*.bak" 2>/dev/null
find / -name "*.backup" 2>/dev/null
find /var/backups/ -type f 2>/dev/null

# Cloud credentials
find / -name "credentials" 2>/dev/null
find / -name "*.pem" 2>/dev/null
find /home/ -name ".aws" 2>/dev/null

Practical Exercises for Skill Building

Exercise 1: File System Exploration

Objective: Familiarize yourself with the Linux directory structure.

1. Navigate to the root directory and list all directories:

   cd /
   ls -l
   

2. Explore each major directory using cd and ls:

   cd /etc
   ls -lh
   cd /var/log
   ls -lh
   cd /usr/bin
   ls | wc -l    # Count binaries
   

3. Find your way back home using different methods:

   cd ~
   cd
   cd $HOME
   

Exercise 2: Finding Files

Objective: Practice using find, locate, and which.

1. Find all .conf files in /etc:

   find /etc/ -name "*.conf" 2>/dev/null
   

2. Locate all Python executables:

   which -a python python3
   whereis python3
   

3. Find recently modified files in /tmp:

   find /tmp/ -type f -mmin -60
   

4. Search for SUID binaries:

   find / -perm -4000 -type f 2>/dev/null | tee suid-binaries.txt
   

Exercise 3: User and System Enumeration

Objective: Practice gathering system information.

1. List all users on the system:

   cat /etc/passwd | cut -d: -f1 | sort
   

2. Find users with UID 0 (root privileges):

   awk -F: '$3 == 0 {print $1}' /etc/passwd
   

3. Check for users with empty passwords:

   sudo awk -F: '$2 == "" {print $1}' /etc/shadow
   

4. List all running services:

   systemctl list-units --type=service --state=running
   

Exercise 4: Log Analysis

Objective: Learn to navigate and analyze system logs.

1. View the last 20 authentication attempts:

   sudo tail -20 /var/log/auth.log
   

2. Find failed SSH login attempts:

   sudo grep "Failed password" /var/log/auth.log | tail -10
   

3. Count failed login attempts by IP:

   sudo grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn
   

4. Monitor logs in real-time:

   sudo tail -f /var/log/syslog
   

Exercise 5: Web Directory Investigation

Objective: Practice web application file system analysis.

1. Find the web root:

   ls -la /var/www/html/
   

2. Search for PHP files:

   find /var/www/ -name "*.php" 2>/dev/null
   

3. Look for configuration files:

   find /var/www/ -name "config*.php" -o -name ".env" -o -name "wp-config.php" 2>/dev/null
   

4. Identify upload directories:

   find /var/www/ -type d \( -name "upload*" -o -name "files" -o -name "media" \) 2>/dev/null
   

Exercise 6: Creating a Custom File System Map

Objective: Document a target system's layout.

Create a script to map the file system:

#!/bin/bash
# filesystem-mapper.sh

echo "[+] File System Reconnaissance"
echo "================================"
echo ""

echo "[*] System Information:"
uname -a
echo ""

echo "[*] Disk Usage:"
df -h
echo ""

echo "[*] Users (UID >= 1000):"
awk -F: '$3 >= 1000 {print $1}' /etc/passwd
echo ""

echo "[*] SUID Binaries:"
find / -perm -4000 -type f 2>/dev/null
echo ""

echo "[*] World-Writable Directories:"
find / -type d -perm -002 2>/dev/null | head -20
echo ""

echo "[*] Cron Jobs:"
cat /etc/crontab 2>/dev/null
ls -la /etc/cron.* 2>/dev/null
echo ""

echo "[+] Reconnaissance Complete"

Run it:

chmod +x filesystem-mapper.sh
./filesystem-mapper.sh > system-map.txt

Integration with Penetration Testing Workflow

Phase 1: Initial Foothold

After gaining initial access to a system:

# Verify access and location
pwd
whoami
id

# Quick system enumeration
uname -a
cat /etc/os-release

# Check user privileges
sudo -l

# Identify current directory permissions
ls -la

Phase 2: Privilege Escalation Research

# Search for SUID binaries
find / -perm -4000 -type f 2>/dev/null

# Check for writable /etc/passwd
ls -la /etc/passwd

# Look for sudo misconfigurations
sudo -l
cat /etc/sudoers 2>/dev/null

# Check for interesting cronjobs
cat /etc/crontab
ls -la /etc/cron.*

# Find writable scripts or binaries
find / -writable -type f 2>/dev/null | grep -v proc

Phase 3: Credential Harvesting

# Command history
cat ~/.bash_history
cat ~/.mysql_history
cat ~/.psql_history

# Configuration files
find /home/ -name "*.conf" 2>/dev/null
find /var/www/ -name "config*.php" 2>/dev/null

# SSH keys
find / -name "id_rsa" 2>/dev/null
cat ~/.ssh/id_rsa
cat ~/.ssh/authorized_keys

# Database credentials
find / -name "*.sql" 2>/dev/null
grep -r "password" /var/www/ 2>/dev/null | grep -i db

Phase 4: Persistence and Lateral Movement

# Identify other users and systems
cat /etc/passwd
cat /etc/hosts
cat ~/.ssh/known_hosts

# Network configuration
ifconfig
ip addr
cat /etc/network/interfaces

# Active connections
netstat -antp
ss -antp
cat /proc/net/tcp

# Installed software
ls /opt/
ls /usr/local/bin/
dpkg -l    # Debian/Ubuntu
rpm -qa    # RHEL/CentOS

Best Practices and Tips

1. Always Know Your Location

# Add to your prompt (edit ~/.bashrc)
PS1='\u@\h:\w\$ '
# Shows: username@hostname:/current/path$

2. Use Tab Completion

Press Tab to autocomplete file and directory names. Press Tab twice to see all possibilities.

3. Navigate Efficiently

# Use cd - to toggle between directories
cd /etc/
cd /var/log/
cd -    # Back to /etc/
cd -    # Back to /var/log/

# Use pushd and popd for directory stack
pushd /etc/
pushd /var/log/
pushd /tmp/
dirs    # View stack
popd    # Return to previous

4. Redirect Errors

When searching the entire filesystem, suppress "Permission denied" errors:

find / -name "config.php" 2>/dev/null

5. Combine Commands with Pipes

# Find and count
find /etc/ -name "*.conf" 2>/dev/null | wc -l

# Find and display
find / -perm -4000 2>/dev/null | xargs ls -lh

# Grep through multiple files
find /var/www/ -name "*.php" -exec grep -l "mysql_connect" {} \;

6. Document Everything

Save command output for reporting:

find / -perm -4000 2>/dev/null | tee suid-report.txt
uname -a >> system-info.txt
cat /etc/passwd >> system-info.txt

7. Learn to Read Permissions

# ls -l output format:
# -rwxr-xr-x 1 owner group size date name
#  ↑ ↑ ↑ ↑ ↑ ↑
#  │ │ │ │ │ └─ File type
#  │ │ │ │ └─── Owner permissions (rwx = 7)
#  │ │ │ └───── Group permissions (r-x = 5)
#  │ │ └─────── Others permissions (r-x = 5)
#  │ └───────── Number of hard links
#  └─────────── File type (- = file, d = directory, l = link)

# Permission calculation:
# r (read) = 4
# w (write) = 2
# x (execute) = 1
# rwx = 7, rw- = 6, r-x = 5, r-- = 4

8. Use Aliases for Efficiency

Add to ~/.bashrc:

alias ll='ls -lah'
alias ..='cd ..'
alias ...='cd ../..'
alias h='history'
alias ports='netstat -antp'
alias fs='find / -name'

Reload:

source ~/.bashrc

Common Mistakes to Avoid

1. Confusing /root and /

• / is the root directory (top of the file system)
• /root is the home directory of the root user

2. Forgetting Error Redirection

# Bad - cluttered output
find / -name config.php

# Good - clean output
find / -name config.php 2>/dev/null

3. Not Using Quotes for Filenames with Spaces

# Wrong
cat my file.txt    # Tries to cat "my" and "file.txt"

# Right
cat "my file.txt"
cat my\ file.txt

4. Overwriting Important Files

# Very dangerous - redirects to the same file
grep pattern file.txt > file.txt    # Empties file.txt!

# Safe - use a different output file
grep pattern file.txt > output.txt

5. Not Checking Current Directory Before Using .

# Dangerous if you're in the wrong location
rm -rf .

# Always verify first
pwd
ls -la

Frequently Asked Questions (FAQ)

Q1: What's the difference between /bin, /usr/bin, /sbin, and /usr/sbin?

A: These directories traditionally served different purposes:

• /bin: Essential command-line utilities needed for single-user mode and system repair (bash, ls, cat, cp, rm)
• /sbin: Essential system administration commands needed for boot and recovery (fsck, init, reboot, iptables)
• /usr/bin: User commands and applications for normal system operation (less critical than /bin)
• /usr/sbin: System administration tools for regular multi-user operation

The distinction was based on:

• Essential vs. non-essential: /bin and /sbin contain critical tools needed if /usr isn't mounted
• User vs. admin: bin directories for regular users, sbin for system administrators

Modern systems: Many distributions now symlink /bin → /usr/bin and /sbin → /usr/sbin because separate /usr partitions are less common. Kali Linux follows this unified approach.

For pentesters: Search both locations when hunting for binaries:

find /bin /sbin /usr/bin /usr/sbin -name "python*"

Q2: How do I find files modified by an attacker after a specific date?

A: Use find with time-based options:

# Files modified in the last N days
find / -type f -mtime -7    # Last 7 days

# Files modified in the last N minutes
find / -type f -mmin -60    # Last 60 minutes

# Files modified after a specific date
touch -t 202601150000 /tmp/timestamp    # Jan 15, 2026 00:00
find / -newer /tmp/timestamp 2>/dev/null

# More precise: files modified between dates
touch -t 202601150000 /tmp/start
touch -t 202601200000 /tmp/end
find / -newer /tmp/start ! -newer /tmp/end 2>/dev/null

# Focus on critical directories
find /etc /var/www /home -type f -mtime -1

# Sort by modification time
find /var/www/ -type f -mtime -7 -exec ls -lt {} + | head -20

Incident response tip: Attackers often modify /etc/passwd, /etc/shadow, web shell files, or cron jobs. Check these first:

ls -la /etc/passwd /etc/shadow /etc/crontab
find /var/www/ -name "*.php" -mtime -1

Q3: What are SUID binaries, and why are they important for pentesting?

A: SUID (Set User ID) is a special permission that allows a program to run with the privileges of its owner (usually root), regardless of who executes it.

How it works:

# Example: ping needs root to create raw sockets
ls -l /bin/ping
# -rwsr-xr-x ... /bin/ping
#    ↑
#    s = SUID bit

When you run ping, it temporarily executes with root privileges even though you're a regular user.

Why pentesters care:

1. Privilege escalation: Misconfigured or vulnerable SUID binaries can be exploited to gain root access
2. GTFOBins: Many SUID binaries can be abused (e.g., nmap --interactive in old versions)

Find SUID binaries:

# Find all SUID files
find / -perm -4000 -type f 2>/dev/null

# Find SGID files (similar concept, group ID)
find / -perm -2000 -type f 2>/dev/null

# Find both
find / -perm -4000 -o -perm -2000 2>/dev/null

# Detailed listing
find / -perm -4000 -type f -exec ls -lh {} \; 2>/dev/null

# Common exploitable SUID binaries to check:
# - find, nmap (old versions), vim, bash, more, less, nano, cp, mv

Exploitation example (if find has SUID):

find /home -exec /bin/sh -p \;    # Spawns root shell

Resources:

• GTFOBins - Database of SUID-exploitable binaries
• Check andraxpentester.in's privilege escalation guides for detailed exploitation techniques

Q4: How do I safely practice these commands without breaking my system?

A: Follow these safety practices:

1. Use a Virtual Machine:

# Practice in Kali Linux VM or any disposable Linux instance
# Quick setup: https://andraxpentester.in/tutorials/how-to-install-kali-linux-in-virtualbox-complete-2026-guide

2. Create Snapshots:

• Before practicing, take a VM snapshot
• If you break something, revert to the snapshot

3. Use a Test Directory:

# Create a safe playground
mkdir -p ~/practice-area
cd ~/practice-area

# Create test files and directories
mkdir -p test/{dir1,dir2,dir3}
touch test/file{1..10}.txt
echo "Sample content" > test/file1.txt

# Practice here instead of system directories
find ~/practice-area -name "*.txt"
ls -la ~/practice-area/test/

4. Use Read-Only Commands First:

Safe commands (won't modify anything):

• ls, cat, less, more
• find (without -exec or -delete)
• pwd, cd, which, whereis
• grep, head, tail

Potentially dangerous commands:

• rm, mv, chmod, chown
• find with -exec or -delete
• > (redirect/overwrite)
• dd, mkfs

5. Use -i Interactive Mode:

# Prompt before each removal
rm -i file.txt

# Prompt before overwriting
mv -i source.txt dest.txt
cp -i file1 file2

6. Double-Check Before Destructive Operations:

# Bad - immediate deletion
rm -rf /path/to/dir

# Good - verify first
ls /path/to/dir
du -sh /path/to/dir
# Then, if correct:
rm -rf /path/to/dir

7. Add Safety Aliases to ~/.bashrc:

alias rm='rm -i'
alias mv='mv -i'
alias cp='cp -i'

8. Practice on Purpose-Built Systems:

• OverTheWire Bandit - Linux command practice wargame
• HackTheBox - Vulnerable VMs for pentesting practice
• Local Docker containers

Q5: What's the best way to remember all these directory locations and commands?

A: Use these memory techniques and reference materials:

1. Create a Visual Cheat Sheet:

Save this as ~/filesystem-cheatsheet.txt:

Linux File System Quick Reference
==================================
/           Root (everything starts here)
/root       Root user's home
/home       User home directories
/etc        Configuration files
/var        Variable data (logs, databases)
/tmp        Temporary files (world-writable)
/usr        User programs and data
/opt        Optional/third-party software
/bin        Essential commands
/sbin       System admin commands
/dev        Device files
/proc       Process information (virtual)
/var/log    System logs

Navigation:
cd          Change directory
cd ~        Go home
cd ..       Up one level
cd -        Previous directory
pwd         Print working directory

Listing:
ls -la      Long format, all files
ls -lh      Human-readable sizes
ls -lt      Sort by time

Finding:
find / -name "file"         Find by name
find / -type f -mtime -7    Modified last 7 days
find / -perm -4000          SUID binaries
locate file                 Fast search (uses DB)
which command               Find in PATH

2. Practice Regularly:

# Daily practice routine (5 minutes)
cd /
ls -la
pwd
cd /etc && ls -lh | head
cd /var/log && ls -lh
find /home -name "*.txt" 2>/dev/null | head -5
cd ~

3. Use Mnemonics:

• /etc = "Et Cetera" (configuration files)
• /var = "Variable" (changing data like logs)
• /tmp = "Temporary"
• /usr = "Unix System Resources" (not "user"!)
• /opt = "Optional" packages
• /bin = "Binaries" (executables)

4. Create Path Association Stories: "When I log in as root (/root), I check the system logs (/var/log) and review configuration files (/etc) before making changes. Then I check my tools in /opt and look at web applications in /var/www."

5. Use Command History:

# Search command history
history | grep find
Ctrl + R    # Then type search term (interactive)

# Save useful commands
echo "find / -perm -4000 2>/dev/null" >> ~/useful-commands.txt

6. Build Muscle Memory:

Set yourself these weekly challenges:

• Week 1: Navigate to 10 different directories daily
• Week 2: Use find with 3 different criteria each day
• Week 3: Analyze logs and configuration files
• Week 4: Complete a full system enumeration simulation

7. Keep Reference Cards:

Print and keep near your workstation:

• Linux File System Hierarchy Chart
• Essential Linux Commands Poster
• Create custom quick-reference cards for your most-used commands

8. Use Spaced Repetition:

Use flashcard apps (Anki, Quizlet) with questions like:

• Q: Where are password hashes stored? A: /etc/shadow
• Q: Command to find SUID binaries? A: find / -perm -4000 2>/dev/null
• Q: Where are system logs typically located? A: /var/log/

9. Integrate Into Practice:

Whenever you work through pentesting tutorials (like those on andraxpentester.in), actively use these commands rather than copy-pasting.

10. Bookmark Quality References:

• Official Kali Linux Documentation
• Linux.org Learning Resources
• andraxpentester.in Tutorials

Next Steps in Your Learning Journey

Now that you understand the Linux file system, you're ready to:

1. Master File Permissions: Learn about read, write, execute permissions, SUID, SGID, and sticky bits
2. Learn File Manipulation: Commands like cat, grep, sed, awk for working with file contents
3. Process Management: Understanding running processes, /proc filesystem, and process manipulation
4. Network Configuration: Deep dive into network interfaces, routing, and firewall rules
5. Privilege Escalation: Exploit file system misconfigurations for security testing

Continue your Kali Linux learning path with our tutorial series, and practice these concepts in real-world scenarios. Remember, consistent hands-on practice is the key to mastery.

Conclusion

The Linux file system hierarchy is the foundation of effective system administration and penetration testing. By understanding the purpose of each directory, mastering navigation commands, and knowing where to look for critical files, you've taken a significant step toward becoming a proficient ethical hacker.

Key takeaways:

• Everything starts at the root directory /
• Each directory has a specific purpose (configuration, logs, binaries, etc.)
• Navigation commands (cd, ls, pwd) are your primary tools
• The find command is essential for comprehensive file searches
• Understanding file types and permissions is crucial
• Critical pentesting files are in /etc, /var/log, /home, and application-specific directories

Remember: knowledge alone isn't enough. Set up your Kali Linux environment, practice these commands daily, and apply them in realistic scenarios. The file system is your roadmap - learn to read it fluently, and you'll navigate any Linux system with confidence.

Happy hacking, and stay ethical!

About the Author: Syed Abrar (Andrax Pentester) is a cybersecurity professional specializing in penetration testing and ethical hacking education. Follow more tutorials and security research at andraxpentester.in.

Disclaimer: The techniques described in this tutorial are for educational purposes and authorized security testing only. Always obtain proper authorization before testing any system you don't own. Unauthorized access to computer systems is illegal.