Hacking Trainer AcademyAmeerpet · Hyderabad
+91 86868 92922 Book free classes

Careers

Linux Commands for Cyber Security: Beginner Cheat Sheet

· 2 min read · By Thimmagurudu Bathini, Lead Trainer and Curriculum Designer

Almost every security tool runs on Linux, and most servers you will defend or test run it too. You do not need to memorize hundreds of commands. Learn these, in a virtual machine you can break safely.

Move Around and Read Files

  • pwd shows where you are; ls -la lists files with permissions and hidden files; cd changes folder.
  • cat file prints a file; less file lets you scroll; head and tail show the start and end.
  • tail -f /var/log/auth.log follows a log live.
  • grep "Failed password" /var/log/auth.log finds lines containing text.
  • grep -r "password" /etc 2>/dev/null searches a folder tree.
  • find / -name "*.conf" 2>/dev/null finds files by name.

Permissions and Users

  • whoami and id show who you are.
  • chmod 600 file and chown user file change permissions and owner.
  • sudo runs a command as administrator. A file readable by everyone, or a program with a risky setuid bit, is a typical weakness; see privilege escalation explained.

Processes and Network

  • ps aux lists processes; top shows them live.
  • ip a shows addresses; ss -tulpn shows what is listening and which program owns it.
  • curl -I http://192.168.56.20/ fetches headers from a web server.

For the ideas behind these, read networking basics for cybersecurity.

Turn a Log into an Answer

Combine commands with pipes. This counts failed SSH logins per source address:

  • grep "Failed password" /var/log/auth.log | awk '{print $11}' | sort | uniq -c | sort -nr

The address is usually the eleventh field, but lines for invalid users differ, so check your own log. This is the same thinking a SIEM applies at scale; see what is a SIEM.

Next Steps

Install Kali or Ubuntu in a VM (Kali Linux for beginners), practice daily for two weeks and keep a cheat sheet in your own words.

Sources and Further Reading

Starting from zero? Ask a counselor which first step suits you. Contact us or call +91 86868 92922.

Courses Mentioned in This Guide

Beginner to intermediate · Course · 6 weeks, 90 hours

SOC Analyst and DFIR

The core concepts of EC-Council's CCT, CSA, ECIH and CHFI, taught hands-on with Splunk, Wazuh and forensics tools, in six weeks.

₹20,000 + GST · 6 weeks

  • CCT, CSA, ECIH, CHFI core concepts
  • Splunk and Sentinel
  • Phishing triage and hunting
  • Incident handling
  • Forensics and malware analysis
View the course →
Advanced · Course · 6 weeks, 90 hours

Network and Active Directory Penetration Testing (Advanced)

Become a network penetration tester: advanced enumeration, exploitation, pivoting and Active Directory forest attacks, in six weeks.

₹20,000 + GST · 6 weeks

  • Pivoting and lateral movement
  • AD forest, delegation and AD CS attacks
  • Nessus and configuration review
  • Hashcat and password attacks
  • AI-assisted reporting
View the course →
Beginner · EC-Council certification

Certified Cybersecurity Technician (CCT)

Foundations and practical security skills for a first security role.

  • Network security basics
  • Security controls
  • Monitoring and logs
  • Incident response basics
View the certification →

More Guides

Careers · 2 min read

SOC Analyst vs Penetration Tester: Which Career for a Fresher?

SOC analyst or penetration tester? Compare the daily work, skills, entry route, shifts and openings for freshers in Hyderabad, and how to choose.

Read the guide →
Careers · 3 min read

SOC Analyst Interview Questions for Freshers, with Answers

Fifteen SOC analyst interview questions for freshers with short model answers: logs, phishing, alerts, networking, SIEM, incident response and ATT&CK.

Read the guide →
SOC and blue team · 2 min read

What Is MITRE ATT&CK? A Beginner's Guide for SOC and Red Teams

MITRE ATT&CK explained: tactics, techniques and sub-techniques, how SOC analysts map detections to it, how red teams use it, and how to start learning it.

Read the guide →
SOC and blue team · 2 min read

Sysmon for Beginners: Install, Config and Event IDs

Install Sysmon on a Windows lab VM, apply a config, and read the key events for process creation, network connections and DNS, with PowerShell commands.

Read the guide →

Start Your Cyber Security Career

Talk to a counselor, choose the right course for your goals, and get the fee, syllabus and next batch dates in writing.

Book Free Trial Classes

By submitting, you agree that Hacking Trainer Academy may contact you about courses by phone, WhatsApp or email. See our privacy notice and refund policy.

WhatsApp