Master the Linux terminal from scratch. Learn bash commands, pipes, redirections, environment variables, and essential command line skills for Kali Linux penetration testing. Complete beginne
A step-by-step penetration testing lab guide. Learn how to setup a test environment, identify BOLA vulnerabilities using Burp Suite Repeater/Match & Replace, and implement secure code fixes.
45 min read
A practical, step-by-step tutorial on identifying, requesting, extracting, and cracking offline password hashes for vulnerable Active Directory Kerberos service accounts.
Master the Linux terminal and unlock the full power of Kali Linux for penetration testing and cybersecurity work. This comprehensive beginner-friendly guide teaches you essential command line skills, bash fundamentals, pipes, redirections, and terminal productivity techniques.
Whether you're starting your penetration testing journey or transitioning from GUI-based tools, understanding the linux terminal is crucial for effective security work. By the end of this tutorial, you'll be comfortable navigating, manipulating files, chaining commands, and customizing your command line environment.
Before diving into linux terminal commands, let's clarify three commonly confused terms:
A terminal or terminal emulator is a graphical application that provides a window where you can interact with the shell. In Kali Linux, the default terminal emulator displays a text interface where you type commands.
Examples: GNOME Terminal (Kali default), Terminator, Konsole, xterm
A shell is the program that interprets your commands and communicates with the operating system kernel. It's the command-line interface (CLI) itself, not the window containing it.
Examples: Bash (Bourne Again Shell), Zsh, Fish, Dash
Kali Linux uses Bash by default, which we'll focus on in this tutorial.
A console historically refers to the physical text terminal connected directly to the computer. In modern Linux systems, virtual consoles (accessible via Ctrl+Alt+F1 through F6) provide direct system access without a graphical environment.
Key Difference: Terminal emulator (graphical window) → Shell (command interpreter) → Operating System
Bash (Bourne Again Shell) is the default shell in Kali Linux and most Linux distributions. Understanding bash basics is essential for linux terminal proficiency.
echo $SHELL
# Output: /bin/bash
A typical bash prompt looks like:
kali@kali:~$
Breaking it down:
kali - Username@ - Separatorkali - Hostname~ - Current directory (tilde represents home directory)$ - Regular user prompt (# indicates root user)pwd # Print Working Directory
cd /etc # Change to /etc directory
cd ~ # Change to home directory
cd .. # Go up one directory level
cd - # Return to previous directory
ls # List directory contents
ls -la # List all files with details
Pro Tip: Before starting penetration testing with Nmap, master these navigation basics.
Every linux terminal command follows a consistent structure:
command [options] [arguments]
1. Command - The program or built-in shell function to execute
ls
2. Options (Flags) - Modify command behavior, usually prefixed with - or --
ls -l # Long format (single dash, short option)
ls --all # Show all files (double dash, long option)
ls -la # Combine multiple short options
3. Arguments - Data the command operates on (files, directories, strings)
cat file.txt # Single argument
cp source.txt dest.txt # Multiple arguments
grep -i "password" /etc/passwd
# grep = command
# -i = option (case insensitive)
# "password" = search pattern (argument)
# /etc/passwd = file to search (argument)
man ls # View manual page for ls command
man -k network # Search man pages for "network"
ls --help # Quick help (most GNU commands)
Unix-like systems use three standard data streams for command input and output:
Data fed into a command, typically from keyboard or another command.
cat # Reads from stdin (keyboard)
# Type text, press Ctrl+D to end
Normal command output, displayed on screen by default.
ls -l # Sends file list to stdout
Error messages and diagnostics, separate from normal output.
cat nonexistent.txt
# Error message goes to stderr, not stdout
Why separate stderr? You can redirect normal output to a file while still seeing errors on screen, or handle them differently.
The pipe operator | connects stdout of one command to stdin of another, enabling powerful command chains.
command1 | command2
Output from command1 becomes input to command2.
1. Search command output:
ps aux | grep firefox
# List all processes, then filter for firefox
2. Count files in directory:
ls -1 | wc -l
# List one file per line, count lines
3. Sort and find unique values:
cat access.log | cut -d' ' -f1 | sort | uniq -c | sort -rn
# Extract IPs → sort → count unique → sort by frequency
4. Real-time log monitoring:
tail -f /var/log/syslog | grep error
# Follow log file and filter for errors
netstat -tuln | grep LISTEN | awk '{print $4}' | cut -d: -f2 | sort -n
# List listening ports, extract port numbers, sort numerically
Penetration Testing Use: Pipe commands are essential for reconnaissance and data analysis in security work.
Redirection operators control where command input comes from and where output goes.
> - Redirect stdout (overwrite)
ls -l > filelist.txt
# Save directory listing to file, overwriting if exists
>> - Redirect stdout (append)
echo "New log entry" >> logfile.txt
# Add text to end of file, preserving existing content
2> - Redirect stderr
find / -name "config" 2> errors.txt
# Save error messages to file, display results on screen
&> or 2>&1 - Redirect both stdout and stderr
command &> all_output.txt
# Modern syntax, redirects everything
command > output.txt 2>&1
# Traditional syntax, same result
< - Redirect stdin
sort < unsorted.txt
# Feed file contents as input to sort command
wc -l < file.txt
# Count lines, reading from file
cat << EOF > newfile.txt
Line 1
Line 2
Line 3
EOF
# Create multi-line file content
1. Separate success and error logs:
./scan_script.sh > results.txt 2> errors.log
2. Discard unwanted output:
find / -name "*.conf" 2> /dev/null
# Suppress permission denied errors
3. Append timestamped logs:
echo "[$(date)] Scan completed" >> pentest_log.txt
Bash remembers your command history, dramatically improving linux terminal efficiency.
history # Display command history with line numbers
history 20 # Show last 20 commands
history | grep ssh # Search history for ssh commands
| Shortcut | Action |
|---|---|
↑ / ↓ | Scroll through previous/next commands |
Ctrl+R | Reverse search - type to find matching commands |
Ctrl+G | Exit reverse search |
!! | Execute last command |
!n | Execute command number n from history |
!string | Execute most recent command starting with "string" |
!$ | Last argument of previous command |
!* | All arguments of previous command |
# Run last command as root
sudo !!
# Edit and re-run previous command
^old^new
# Example: ^http^https changes http to https in last command
# Reuse previous command's argument
cat /etc/ssh/sshd_config
nano !$
# Opens /etc/ssh/sshd_config in nano
Edit ~/.bashrc for persistence:
export HISTSIZE=10000 # Commands in memory
export HISTFILESIZE=20000 # Commands saved to disk
export HISTCONTROL=ignoredups # Ignore duplicate commands
export HISTIGNORE="ls:pwd:exit" # Don't save these commands
Security Note: History files can expose sensitive commands. Clear with history -c or use HISTCONTROL=ignorespace and prefix sensitive commands with a space.
Tab completion is the most powerful productivity feature in the linux terminal.
cd /et[TAB]
# Completes to: cd /etc/
cat /etc/pass[TAB]
# Completes to: cat /etc/passwd
ls /usr/bi[TAB][TAB]
# Shows: /usr/bin/ /usr/bin/X11/
net[TAB][TAB]
# Shows all commands starting with "net": netcat, netstat, networkctl, etc.
Modern bash-completion package provides context-aware completion:
sudo apt install bash-completion
# Now works:
ssh user@[TAB] # Completes known hosts
git [TAB][TAB] # Shows git subcommands
systemctl restart [TAB] # Completes service names
Pro Tip: After installing Kali Linux, enable bash-completion for maximum efficiency.
Wildcards (globbing patterns) match multiple filenames with a single expression.
* - Matches Zero or More Charactersls *.txt # All files ending with .txt
ls report* # All files starting with "report"
ls *2026* # All files containing "2026"
rm *.tmp # Delete all .tmp files
? - Matches Exactly One Characterls file?.txt # Matches file1.txt, fileA.txt, not file10.txt
ls ???.log # Matches any 3-character filename with .log
[] - Matches One Character from Setls file[123].txt # Matches file1.txt, file2.txt, file3.txt
ls [A-Z]* # Files starting with uppercase letter
ls *[0-9].log # Files ending with digit and .log
ls [!a-z]* # Files NOT starting with lowercase letter
{}echo {1..10} # Output: 1 2 3 4 5 6 7 8 9 10
mkdir {jan,feb,mar}_reports
cp file.txt{,.bak} # Copy file.txt to file.txt.bak
1. Backup all config files:
cp /etc/*.conf ~/backup/
2. Find and process scan results:
grep -i "open" scan_*.txt
3. Batch rename files:
for file in *.txt; do
mv "$file" "${file%.txt}_2026.txt"
done
Environment variables store configuration data accessible to shell and programs.
echo $HOME # Display home directory path
echo $USER # Current username
echo $SHELL # Current shell
env # List all environment variables
printenv PATH # Display specific variable
| Variable | Purpose | Example |
|---|---|---|
$PATH | Directories searched for commands | /usr/local/bin:/usr/bin:/bin |
$HOME | User's home directory | /home/kali |
$USER | Current username | kali |
$SHELL | Login shell path | /bin/bash |
$PWD | Current working directory | /etc/apache2 |
$OLDPWD | Previous directory | /var/www |
$LANG | System language | en_US.UTF-8 |
$EDITOR | Default text editor | nano or vim |
Temporary (current session only):
MY_VAR="Hello World"
echo $MY_VAR
Permanent (export to child processes):
export MY_VAR="Persistent value"
System-wide persistence - Add to ~/.bashrc or ~/.profile:
echo 'export EDITOR=nano' >> ~/.bashrc
source ~/.bashrc # Reload configuration
Add custom tool directories:
export PATH="$PATH:/opt/custom_tools/bin"
# Or prepend (takes priority):
export PATH="/opt/custom_tools/bin:$PATH"
Security Tools Example:
export PATH="$PATH:$HOME/tools/nmap/bin"
After configuring Kali Linux, set environment variables for your security tools.
FILE="report.txt"
echo ${FILE} # report.txt
echo ${FILE%.txt} # report (remove extension)
echo ${FILE%.txt}.pdf # report.pdf (replace extension)
echo ${FILE:-default.txt} # Use default if FILE unset
Aliases create shortcuts for frequently used commands or complex command chains.
Temporary (current session):
alias ll='ls -lah'
alias update='sudo apt update && sudo apt upgrade -y'
alias ports='netstat -tuln'
Permanent - Add to ~/.bashrc or ~/.bash_aliases:
echo "alias ll='ls -lah'" >> ~/.bashrc
source ~/.bashrc
# Network reconnaissance
alias myip='curl -s ifconfig.me'
alias openports='ss -tuln'
alias listening='lsof -i -P -n | grep LISTEN'
# Safe file operations
alias rm='rm -i' # Prompt before delete
alias cp='cp -i' # Prompt before overwrite
alias mv='mv -i' # Prompt before overwrite
# Enhanced commands
alias grep='grep --color=auto'
alias df='df -h'
alias du='du -h'
# Quick navigation
alias ..='cd ..'
alias ...='cd ../..'
alias home='cd ~'
# Git shortcuts
alias gs='git status'
alias ga='git add'
alias gc='git commit'
alias gp='git push'
# Kali-specific
alias updatekali='sudo apt update && sudo apt full-upgrade -y && sudo apt autoremove -y'
alias nmapdiscovery='nmap -sn'
alias quickscan='nmap -sV -sC'
alias # List all aliases
alias ll # Show specific alias
unalias ll # Remove alias
For commands with arguments, use functions:
# Add to ~/.bashrc
extract() {
if [ -f "$1" ]; then
case "$1" in
*.tar.gz) tar xzf "$1" ;;
*.zip) unzip "$1" ;;
*.rar) unrar x "$1" ;;
*) echo "Unknown archive format" ;;
esac
fi
}
Usage: extract archive.tar.gz
Customize your bash prompt via the PS1 environment variable.
echo $PS1
# Output: \[\e]0;\u@\h: \w\a\]${debian_chroot:+($debian_chroot)}\[\033[01;32m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$
| Code | Meaning |
|---|---|
\u | Username |
\h | Hostname (short) |
\H | Full hostname |
\w | Current directory (full path) |
\W | Current directory (basename) |
\d | Date (Mon Jan 01) |
\t | Time (24-hour HH:MM:SS) |
\@ | Time (12-hour AM/PM) |
\n | Newline |
\$ | $ for user, # for root |
1. Minimalist:
export PS1="\u:\W\$ "
# Output: kali:Documents$
2. With colors:
export PS1="\[\033[1;32m\]\u@\h\[\033[0m\]:\[\033[1;34m\]\w\[\033[0m\]\$ "
# Green username@hostname : Blue path $
3. Multi-line with timestamp:
export PS1="[\t] \u@\h\n\w\$ "
# Example:
# [14:30:45] kali@kali
# /home/kali/Documents$
# Text colors
\033[0;30m # Black
\033[0;31m # Red
\033[0;32m # Green
\033[0;33m # Yellow
\033[0;34m # Blue
\033[0;35m # Magenta
\033[0;36m # Cyan
\033[0;37m # White
# Bold colors: change 0 to 1
\033[1;32m # Bold green
# Reset: \033[0m
Show current git branch:
parse_git_branch() {
git branch 2>/dev/null | grep '^*' | colrm 1 2
}
export PS1="\u@\h:\w \[\033[0;33m\]\$(parse_git_branch)\[\033[0m\]\$ "
Make permanent by adding to ~/.bashrc.
Terminal multiplexers allow multiple terminal sessions within one window, with session persistence.
Installation:
sudo apt install tmux
Essential Commands:
tmux # Start new session
tmux new -s pentest # Named session
tmux ls # List sessions
tmux attach -t pentest # Attach to session
tmux detach # Or: Ctrl+B, D
tmux kill-session -t pentest
Key Bindings (prefix: Ctrl+B):
| Shortcut | Action |
|---|---|
Ctrl+B then % | Split vertically |
Ctrl+B then " | Split horizontally |
Ctrl+B then arrow keys | Navigate panes |
Ctrl+B then C | New window |
Ctrl+B then N | Next window |
Ctrl+B then P | Previous window |
Ctrl+B then D | Detach session |
Ctrl+B then [ | Scroll mode (Q to exit) |
Penetration Testing Workflow:
# Start named session
tmux new -s webtest
# Split screen
Ctrl+B then % # Nmap scan on left pane
Ctrl+B then " # Burp Suite logs on right
Ctrl+B then C # New window for notes
# Detach during long scan
Ctrl+B then D
# Reattach later
tmux attach -t webtest
Alternative to tmux, widely pre-installed:
screen # Start session
screen -S recon # Named session
screen -r recon # Reattach
screen -ls # List sessions
# Inside screen:
Ctrl+A then C # New window
Ctrl+A then N # Next window
Ctrl+A then D # Detach
Ctrl+A then K # Kill window
Remote Long-Running Scans:
ssh user@remote-server
screen -S masscan
nmap -p- -T4 192.168.1.0/24
Ctrl+A then D # Detach, scan continues
# Close SSH, come back later
ssh user@remote-server
screen -r masscan # Resume scan session
Beyond the default GNOME Terminal, alternative emulators offer enhanced features for linux terminal power users.
Features:
Installation:
sudo apt install terminator
Key Shortcuts:
| Shortcut | Action |
|---|---|
Ctrl+Shift+E | Split vertically |
Ctrl+Shift+O | Split horizontally |
Ctrl+Shift+W | Close terminal |
Ctrl+Tab | Cycle terminals |
Ctrl+Shift+T | New tab |
Ctrl+Shift+X | Maximize terminal |
F11 | Fullscreen |
Use Case: Monitor multiple targets simultaneously during penetration tests.
Features:
Installation:
sudo apt install guake
Usage:
F12 to toggle visibilityConfiguration:
Right-click → Preferences:
Workflow:
Keep Guake running in background:
F12 → run command → press F12 to hideAlacritty - GPU-accelerated, extremely fast:
sudo apt install alacritty
Kitty - GPU-based, scriptable:
sudo apt install kitty
Tilix - Drop-down + tiling:
sudo apt install tilix
Experiment to find your preferred workflow after setting up Kali Linux.
Reinforce your linux terminal skills with these hands-on exercises.
Objective: Navigate directories, find files using wildcards and commands.
# 1. Go to /etc directory
cd /etc
# 2. List all .conf files
ls *.conf
# 3. Find all files containing "ssh" in filename
find /etc -name "*ssh*" 2>/dev/null
# 4. Count total configuration files
find /etc -name "*.conf" 2>/dev/null | wc -l
# 5. Search for "Port" in SSH config
grep -i "port" /etc/ssh/sshd_config
Objective: Chain commands, redirect output, process data streams.
# 1. List all running processes, find those containing "python"
ps aux | grep python
# 2. Extract unique login shells from passwd file
cut -d: -f7 /etc/passwd | sort | uniq
# 3. Count logged-in users
who | wc -l
# 4. Save open network connections to file
netstat -tuln > network_connections.txt
# 5. Append system info to report
echo "System: $(uname -a)" >> system_report.txt
echo "Date: $(date)" >> system_report.txt
# 6. Separate errors from output
find / -name "apache" > found.txt 2> errors.txt
Objective: Customize shell environment.
# 1. Display current PATH
echo $PATH
# 2. Add custom directory to PATH (temporary)
export PATH="$PATH:$HOME/mytools"
# 3. Create useful aliases
alias ll='ls -lah --color=auto'
alias ports='netstat -tuln | grep LISTEN'
alias updatekali='sudo apt update && sudo apt upgrade'
# 4. Test aliases
ll
ports
# 5. Make aliases permanent
echo "alias ll='ls -lah --color=auto'" >> ~/.bashrc
source ~/.bashrc
# 6. Create a function for quick note-taking
note() {
echo "[$(date)] $*" >> ~/notes.txt
}
note "Completed terminal mastery exercises"
Objective: Master command recall and shortcuts.
# 1. View last 10 commands
history 10
# 2. Search history for "grep" commands
history | grep grep
# 3. Use reverse search
# Press Ctrl+R, type "ssh", cycle through matches
# 4. Reuse last argument
mkdir ~/testdir
cd !$ # Goes to ~/testdir
# 5. Repeat last command as root
ls /root
sudo !!
# 6. Edit and re-run previous command
echo "http://example.com"
^http^https # Changes to https://example.com
Objective: Work with tmux for multitasking.
# 1. Start named tmux session
tmux new -s practice
# 2. Split screen vertically
# Press: Ctrl+B then %
# 3. Split right pane horizontally
# Navigate to right pane: Ctrl+B then right arrow
# Press: Ctrl+B then "
# 4. Run different commands in each pane
# Pane 1: top
# Pane 2: tail -f /var/log/syslog
# Pane 3: watch -n 1 date
# 5. Create new window
# Press: Ctrl+B then C
# 6. Detach from session
# Press: Ctrl+B then D
# 7. Reattach
tmux attach -t practice
# 8. Kill session when done
tmux kill-session -t practice
Objective: Combine all skills for a reconnaissance task.
# Scenario: Initial network reconnaissance and reporting
# 1. Create project directory structure
mkdir -p ~/pentest/{recon,scans,reports}
cd ~/pentest
# 2. Capture network interfaces and IPs
ip addr show > recon/network_interfaces.txt
route -n > recon/routing_table.txt
# 3. Identify active local network hosts
arp -a | grep -v "incomplete" > recon/local_hosts.txt
# 4. Check open local ports
ss -tuln > recon/open_ports.txt
# 5. Create summary report with timestamp
echo "=== Reconnaissance Report ===" > reports/summary.txt
echo "Date: $(date)" >> reports/summary.txt
echo "Operator: $USER" >> reports/summary.txt
echo "" >> reports/summary.txt
echo "Active Hosts:" >> reports/summary.txt
cat recon/local_hosts.txt >> reports/summary.txt
echo "" >> reports/summary.txt
echo "Open Ports:" >> reports/summary.txt
cat recon/open_ports.txt >> reports/summary.txt
# 6. View report
cat reports/summary.txt
# 7. Create alias for quick report access
alias viewreport='cat ~/pentest/reports/summary.txt'
echo "alias viewreport='cat ~/pentest/reports/summary.txt'" >> ~/.bashrc
Answer: The terminal (or terminal emulator) is the graphical application window. The shell (like bash) is the command interpreter running inside that window. A console refers to physical or virtual text terminals accessed via Ctrl+Alt+F1-F6. In practice:
For most linux terminal work in Kali Linux, you're using a terminal emulator running the bash shell.
Answer: Use sudo (Super User DO) before the command:
sudo command
# Example:
sudo apt update
sudo nmap -sS 192.168.1.1
To run multiple commands as root, start a root shell:
sudo -i # Root shell with root environment
sudo -s # Root shell with current user environment
Security Note: Only use sudo when necessary. Always verify commands before running as root, especially in penetration testing contexts.
Answer: Three main approaches:
1. nohup (no hangup):
nohup long_running_command &
# Output goes to nohup.out
2. screen or tmux:
screen -S longscan
nmap -p- 192.168.1.0/24
# Press Ctrl+A then D to detach
# Later: screen -r longscan
3. systemd service or cron job:
For recurring tasks, create a systemd service or cron job (beyond beginner scope).
Penetration Testing: tmux and screen are essential for long-running scans during engagements.
Answer: Common causes:
1. Missing shebang line:
Scripts need to declare their interpreter:
#!/bin/bash
# Rest of script
2. Relative vs absolute paths:
# In terminal: ./tool works if current directory is in PATH
# In script: Use absolute path /usr/bin/tool
3. Environment variables not set:
Scripts don't inherit your shell environment. Explicitly export variables:
#!/bin/bash
export PATH="$PATH:/opt/tools/bin"
4. Aliases don't work in scripts:
Aliases are interactive shell features. Use functions or full commands in scripts.
5. Permissions:
chmod +x script.sh # Make executable
./script.sh # Run
Answer: Multiple tools help locate commands:
1. which - Shows path to executable:
which python3
# Output: /usr/bin/python3
2. type - Shows command type:
type ls
# Output: ls is aliased to `ls --color=auto'
type cd
# Output: cd is a shell builtin
3. whereis - Finds binary, source, and man pages:
whereis nmap
# Output: nmap: /usr/bin/nmap /usr/share/man/man1/nmap.1.gz
4. command -v - POSIX-compliant location:
command -v python3
# Output: /usr/bin/python3
Checking installed versions:
python3 --version
nmap --version
gcc --version
Congratulations! You've mastered fundamental linux terminal skills essential for penetration testing and cybersecurity work. From understanding terminal vs shell basics to advanced pipe chains, redirections, environment variables, and terminal multiplexing, you now have the command line proficiency needed for effective security operations in Kali Linux.
✅ Terminal basics - Understand the difference between terminal, shell, and console
✅ Command structure - Command + options + arguments pattern
✅ Stream handling - stdin, stdout, stderr and their redirections
✅ Pipes - Chain commands for powerful data processing
✅ History & shortcuts - Efficient command recall and navigation
✅ Wildcards - Pattern matching for batch operations
✅ Environment - Variables, PATH, and shell configuration
✅ Aliases - Create shortcuts for frequent commands
✅ Multiplexers - tmux and screen for persistent sessions
✅ Customization - Tailor your shell prompt and aliases
Continue your Kali Linux journey:
Official Documentation:
Practice:
The linux terminal is your most powerful tool in penetration testing and cybersecurity. Practice daily, create custom aliases for your workflow, and experiment with different tools and techniques. Command line proficiency separates novice users from expert practitioners.
Ready to level up? Join our community at AndraxPentester.in for more tutorials, security writeups, and the latest in ethical hacking education.
Tutorial Series: Linux Terminal Mastery (13 of 105)
Author: Andrax Pentester / Syed Abrar
Difficulty: BEGINNER
Last Updated: 2026
Target Keyword: linux terminal (KD 37)
Stay updated with the latest penetration testing tutorials and cybersecurity content. Follow us for weekly security insights.
#KaliLinux #LinuxTerminal #CommandLine #BashShell #PenetrationTesting #EthicalHacking #Cybersecurity #LinuxTutorial #Beginners #TerminalMastery #CyberSec #InfoSec #HackingTutorial #LinuxBasics #SecurityTraining
35 min read
Master Nano, Vim, and Emacs text editors for penetration testing on Kali Linux. Learn essential commands, shortcuts, and workflows for editing config files, bash scripts, and analyzing securi
28 min read
Sign in to leave a comment.