Beginner Track2 hours
Linux Command Line
6 guided sections and curated resources to get you contest-ready.
Lesson Playbook
6 sections1
Why Linux for CTFs?
Linux is the operating system of choice for security professionals because:
- Most servers run Linux - Understanding it helps you attack and defend
- Powerful command line - Automate tasks, process data, chain tools
- Security tools - Most hacking tools are built for Linux first
- Customizable - Full control over your system
- Free and open source - Audit the code, learn how things work
For CTFs, you can use:
- Kali Linux - Pre-installed security tools
- Ubuntu/Debian - General purpose, easy to learn
- WSL on Windows - Windows Subsystem for Linux
- Docker - Run Linux containers anywhere
2
Essential Navigation Commands
Master these commands to move around the filesystem:
# Where am I?
pwd # Print working directory
# List files
ls # Basic listing
ls -la # Long format, show hidden files
ls -lah # Human-readable sizes
# Change directory
cd /home # Go to /home
cd ~ # Go to home directory
cd .. # Go up one level
cd - # Go to previous directory
# Create and remove
mkdir new_folder # Create directory
mkdir -p a/b/c # Create nested directories
touch file.txt # Create empty file
rm file.txt # Remove file
rm -rf folder/ # Remove directory (careful!)
# Copy and move
cp file.txt backup.txt # Copy file
cp -r dir1/ dir2/ # Copy directory
mv old.txt new.txt # Rename/move filePro tip: Use Tab for auto-completion and ↑/↓ arrows to navigate command history. These will save you hours!
3
Reading and Searching Files
CTF challenges often require finding specific content in files:
# View file contents
cat file.txt # Print entire file
head -n 20 file.txt # First 20 lines
tail -n 20 file.txt # Last 20 lines
less file.txt # Scrollable viewer (q to quit)
# Search inside files
grep "flag" file.txt # Find lines containing "flag"
grep -r "CTF{" ./ # Search recursively
grep -i "password" file.txt # Case insensitive
grep -n "error" log.txt # Show line numbers
grep -E "flag|ctf" file.txt # Regex (OR)
# Find files
find . -name "*.txt" # Find by name
find . -name "flag*" # Find files starting with "flag"
find / -name "*.conf" 2>/dev/null # Find config files
find . -type f -size +1M # Files larger than 1MB
# Powerful combination
find . -type f -exec grep -l "password" {} \;4
Text Processing
Process and transform text data - essential for CTF scripting:
# Sort and unique
sort file.txt # Sort lines alphabetically
sort -n numbers.txt # Sort numerically
sort file.txt | uniq # Remove duplicates
sort file.txt | uniq -c # Count occurrences
# Cut and extract
cut -d':' -f1 /etc/passwd # Extract first field (usernames)
cut -c1-10 file.txt # First 10 characters of each line
# Stream editor (sed)
sed 's/old/new/g' file.txt # Replace all occurrences
sed -n '5,10p' file.txt # Print lines 5-10
# Awk - powerful text processing
awk '{print $1}' file.txt # Print first column
awk -F: '{print $1}' /etc/passwd # Custom delimiter
awk '{sum+=$1} END {print sum}' numbers.txt
# Character translation
echo "hello" | tr 'a-z' 'A-Z' # HELLO
echo "hello" | tr -d 'l' # heo (delete)
# Word count
wc -l file.txt # Count lines
wc -w file.txt # Count words
wc -c file.txt # Count bytes5
Pipes and Redirection
Chain commands together to build powerful one-liners:
# Pipes - output of one command becomes input of next
cat file.txt | grep "flag" | sort | uniq
# Output redirection
echo "hello" > file.txt # Overwrite file
echo "world" >> file.txt # Append to file
command 2> errors.txt # Redirect stderr
command > out.txt 2>&1 # Redirect both
# Input redirection
sort < unsorted.txt
# Real CTF examples:
# Extract all URLs from a file
grep -oE 'https?://[^"]+' file.html
# Decode base64 and search for flag
cat encoded.txt | base64 -d | grep -i flag
# Find all unique email addresses
grep -oE '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+' file.txt | sort -u
# Count occurrences of each word
cat file.txt | tr ' ' '\n' | sort | uniq -c | sort -rnPro tip: Build complex commands step by step. Test each part before adding the next pipe.
6
Permissions and Users
Understanding Linux permissions is crucial for privilege escalation challenges:
# View permissions
ls -la
# -rwxr-xr-x 1 user group 1234 Jan 1 00:00 file.txt
# ^^^ Owner permissions (read, write, execute)
# ^^^ Group permissions
# ^^^ Others permissions
# Change permissions
chmod 755 script.sh # rwxr-xr-x
chmod +x script.sh # Add execute permission
chmod u+w file.txt # Add write for user
# Change owner
chown user:group file.txt
chown -R user folder/ # Recursive
# Special permissions (important for CTF)
find / -perm -4000 2>/dev/null # Find SUID binaries
find / -perm -2000 2>/dev/null # Find SGID binaries
# Current user info
whoami # Current username
id # User and group IDs
groups # Group memberships
sudo -l # What can I run as sudo?