Foundations | Linux 201

Attribution

These short Linux 201 notes are based on our own study of Linux Basics For Hackers: Getting Started with Networking, Scripting, and Security in Kali by OccupyTheWeb. If you are new to Linux, we highly recommend this book.

Getting Started with the Basics

The Linux Filesystem

Key directories to know:

• /mnt: Where other filesystems are attached or mounted
• /media: Where CDs and USB devices are usually mounted
• /lib: Where you will find libraries (shared programs similar to Windows DLLs)

Basic Commands

Essential commands: pwd, whoami, cd, ls, man, locate, grep, cat, touch, mkdir, cp, mv, rm, rmdir

Finding Files:

• whereis: Returns the location, source, and man page of a binary
• which: Only returns the location of binaries in the PATH variable
• find: Displays exact name matches (use wildcards for broader searches)

Wildcards:

• *: Matches any character(s)
• ?: Matches a single character
• [ ]: Matches characters inside the brackets. Example: [c,b]at matches ‘cat’ and ‘bat’ but not ‘hat’.

Text Manipulation

First, install Snort (a network intrusion detection system):

sudo apt install snort

Viewing Files

Useful commands: head, tail, grep, more, less

• nl: Numbers the lines in a file
• sed: Stream editor for searching and replacing text

SED examples

Replace all occurrences:

sed s/mysql/MySQL/g /etc/snort/snort.conf > snort2.conf

Replace only the first occurrence:

sed s/mysql/MySQL/ /etc/snort/snort.conf > snort2.conf

Replace only the second occurrence:

sed s/mysql/MySQL/2 snort.conf > snort2.conf

Analyzing and Managing Networks

Basic network commands: ifconfig, iwconfig

Changing Network Settings

Change IP address:

ifconfig eth0 192.168.182.155

Change network mask and broadcast address:

ifconfig eth0 192.168.182.115 netmask 255.255.0.0 broadcast 192.168.1.255

Spoofing Your MAC Address

# Take down the interface
ifconfig eth0 down

# Set new MAC address
ifconfig eth0 hw ether 00:11:22:33:44:55

# Bring the interface back up
ifconfig eth0 up

DHCP Process

Request a new IP address:

dhclient eth0

DHCP uses UDP (server port 67, client port 68) and follows the DORA process:

1. Discovery – Client sends DHCPDISCOVER
2. Offer – Server sends DHCPOFFER
3. Request – Client sends DHCPREQUEST
4. Acknowledge – Server sends DHCPACK

DNS Configuration

Change your DNS server:

echo "nameserver 1.1.1.1" > /etc/resolv.conf

The OS queries each DNS server in the order they appear in /etc/resolv.conf.

Custom IP-to-domain mapping:

Edit /etc/hosts to create custom mappings. Use TAB (not space) between the IP and domain:

192.168.1.1    bankofamerica.com

Adding and Removing Software

Using APT

• Search for packages: apt-cache search <keyword>
• Install software: apt-get install <packagename>
• Remove software: apt-get remove <packagename>
• Purge (remove including config files): apt-get purge <packagename>
• Update package list: apt-get update
• Upgrade packages: apt-get upgrade

Repository Categories (Ubuntu)

• main – Supported open source software
• universe – Community-maintained open source software
• multiverse – Software restricted by copyright or legal issues
• restricted – Proprietary device drivers
• backports – Packages from later releases

Avoid: testing, experimental, unstable

GUI Installers

Install Synaptic for a graphical package manager:

apt install synaptic

Installing from Git

Example: Installing bluediving (Bluetooth hacking suite):

git clone https://github.com/balle/bluediving.git

Controlling File and Directory Permissions

Key commands: chown, chgrp, chmod

Understanding UMASK

Linux assigns base permissions automatically (666 for files, 777 for directories). The umask value represents permissions to remove from these base values.

• Default umask on Kali: 022
• Resulting permissions: 644 for files, 755 for directories
• Check current value: umask
• Set personal default in: /home/<username>/.profile

Special Permissions

SUID (Set User ID):

• Allows any user to execute a file with the owner’s permissions
• Set with: chmod 4644 <filename>
• Appears as rws instead of rwx

SGID (Set Group ID):

• Grants temporary elevated group permissions
• On directories: new files inherit the directory’s group ownership
• Set with: chmod 2644 <filename>

Sticky Bit:

• Legacy permission for directory deletion rights
• Modern Linux largely ignores this

Privilege Escalation Check:

find / -user root -perm -4000

Process Management

Key commands: ps, top, nice, renice, kill, &, fg, at, crond

Viewing Processes

Running ps without options lists processes started by the current user on that terminal.

Process Priority with NICE

The nice command suggests priority levels for processes. Values range from -20 (highest priority) to +19 (lowest priority). The default is 0.

• Only root can set negative values (higher priority)
• Any user can increase nice values (lower priority)

Start a process with specific priority:

nice -n -10 /bin/slowprocess

Change priority of running process:

renice 20 <pid>

Killing Processes

• Restart a process: kill -1 <pid>
• Force terminate: kill -9 <pid>
• Kill by name: killall -9 <process-name>

Scheduling with AT

The at daemon runs commands at specified times:

at 7:20am
at> /root/myscanningscript

Managing User Environment Variables

Variables are strings in key-value pairs: KEY=value or KEY=value1:value2.

Types:

• Shell variables: Lowercase, valid only in the shell where set
• Environment variables: System-wide, inherited by child processes

Common Operations

List all environment variables:

set | more

Change a value for the current session:

HISTSIZE=0

Make changes permanent:

export HISTSIZE

Customizing Your Prompt

Make your prompt look like Windows CMD:

export PS1='C:\w> '

Modifying PATH

Add a new directory to your PATH:

PATH=$PATH:/<new-path>

Creating User Variables

# Create a variable
TESTVAR="test"
echo $TESTVAR

# Delete a variable
unset TESTVAR

# Export to make it available system-wide
export TESTVAR

Bash Scripting

Every script starts with a shebang to specify the interpreter:

#!/bin/bash

Example: MySQL Scanner

#!/bin/bash

# This script finds hosts with MySQL installed
nmap -sT 192.168.1.0/24 -p 3306 >/dev/null -oG MySQLscan
cat MySQLscan | grep open > MySQLscan2
cat MySQLscan2

Example: Advanced MySQL Scanner with User Input

#!/bin/bash

echo "Enter the starting IP address: "
read FirstIP

echo "Enter the last octet of the last IP address: "
read LastOctetIP

echo "Enter the port number you want to scan for: "
read port

nmap -sT $FirstIP-$LastOctetIP -p $port >/dev/null -oG MySQLscan
cat MySQLscan | grep open > MySQLscan2
cat MySQLscan2

Compressing and Archiving

Archiving with TAR

Create an archive:

tar -cvf tarball.tar file1 file2 file3

View archive contents:

tar -tvf tarball.tar

Extract files:

tar -xf tarball.tar

Note: If extracted files already exist, tar replaces them.

Compression Methods

GZIP:

gzip file.tar          # Compress
gunzip file.tar.gz     # Decompress

BZIP2:

bzip2 files.tar        # Compress
bunzip2 files.tar.bz2  # Decompress

Creating Disk Images with DD

The dd command makes bit-by-bit copies of files, filesystems, or entire drives.

Basic syntax:

dd if=inputfile of=outputfile

Example:

dd if=/dev/sdb of=/root/flashcopy

Useful options:

• bs=4096 – Set block size (typically 4KB)
• conv=noerror – Continue copying even if errors occur

Full example:

dd if=/dev/media of=/root/flashcopy bs=4096 conv=noerror

Filesystem and Storage Device Management

Key concepts:

• Mounting: Attaching drives to the filesystem
• Partitions: Sections of drives (represented with numbers in device names)

The /dev directory contains files representing each attached device.

Viewing Partitions

sudo fdisk -l

Device Types

• Character devices (c): External devices like mice and keyboards that send data character by character.
• Block devices (b): Hard drives and DVDs that communicate in blocks of data for higher throughput.

Listing Block Devices

lsblk

Mounting and Unmounting

Storage devices must be both physically connected and logically attached (mounted) to be accessible.

Common mount points:

• /mnt – Internal hard drives
• /media – External USB devices

Mount a device:

mount /dev/sdb1 /mnt

Unmount a device:

umount /dev/sdb1

The /etc/fstab file (filesystem table) stores which filesystems mount at boot.

Checking Disk Space

df

Filesystem Check

Check and repair filesystem errors:

fsck /dev/sdb1

Important: Always unmount the drive before running fsck.

The Logging System

Linux uses syslogd (or rsyslogd) to log events automatically.

Configuration file: /etc/rsyslog.conf

Logging Rules Format

facility.priority action

Facilities:

Priorities:

• From highest to lowest: debug, info, notice, warning, err, crit, alert, emerg.
• When you specify a priority, messages of that priority and higher are logged.

Actions:

• Usually a filename in /var/log (e.g., /var/log/auth.log)

Log Rotation

Log rotation archives old logs and creates fresh ones. Configuration: /etc/logrotate.conf

Example: /var/log/auth becomes /var/log/auth.1, then /var/log/auth.2, etc.

Removing Evidence Securely

The shred command overwrites files before deletion:

shred -f -n 10 /var/log/auth.log.*

Options:

• -f : Change permissions to allow writing if necessary
• -n 10 : Overwrite 10 times instead of default

Disabling Logging

Stop the rsyslog daemon (requires root):

service rsyslog stop

Using and Abusing Services

Service

A service is an application that runs in the background waiting for requests.

Manage services:

service <service-name> start|stop|restart

Apache Web Server

Install and start:

apt-get install apache2
service apache2 start

Test by visiting http://localhost/. The default web root is /var/www/html/index.html.

MySQL

Start the service:

service mysql start

Log in:

sudo mysql -u root -p

Common SQL commands:

• SELECT : Retrieve data
• UNION : Combine results from multiple selects
• INSERT : Add new data
• UPDATE : Modify existing data
• DELETE : Remove data

Useful MySQL commands:

-- List users
select user, host, password from mysql.user;

-- List databases
show databases;

-- Select a database
use mysql;

-- List tables
show tables;

-- Describe table structure
describe user;

-- Select data
SELECT columns FROM table;
SELECT * FROM table;

Connect to a remote database:

mysql -u root -p 192.168.4.4

PostgreSQL with Metasploit

Metasploit uses PostgreSQL to store modules and scan results.

Start the database:

service postgresql start

Initialize Metasploit database:

msfconsole
msfdb init

Create a database user:

su postgres
createuser msf_user -P
createdb --owner=msf_user test_db
exit

Connect Metasploit:

db_connect msf_user:[email protected]/test_db
db_status

Becoming Secure and Anonymous

Basic command: traceroute

Proxy Servers

Proxy servers act as intermediaries for your traffic.

Configure proxychains:

Edit /etc/proxychains4.conf and add proxies to the [ProxyList] section:

[ProxyList]
socks4 114.134.186.12 22020
socks4 188.187.190.59 8888

Scan through a proxy:

proxychains nmap -sT -Pn <ip-address>

Browse through a proxy:

proxychains firefox testsite.example.com

Available modes: dynamic chaining, random chaining

Understanding and Inspecting Wireless Networks

Basic command: iwconfig

Scan for access points:

iwlist wlan0 scan

Using NMCLI

The Network Manager command-line interface provides high-level network control.

List Wi-Fi access points:

nmcli dev wifi

Connect to a network:

nmcli dev wifi connect <AP-SSID> password <AP-password>

Managing the Linux Kernel and Loadable Kernel Modules

Loadable Kernel Modules (LKMs)

LKMs can be added without rebuilding the entire kernel. They have access to the lowest system levels.

Security note: Rootkits often use LKMs to embed themselves in the kernel, potentially controlling what the system reports about processes, ports, and services.

Check kernel version:

uname -a
cat /proc/version

Kernel Tuning with SYSCTL

The sysctl command tunes kernel parameters (memory allocation, networking features, security hardening). Note, changes made with sysctl last only until reboot. For permanent changes, edit /etc/sysctl.conf.

List all kernel options:

sysctl -a | less

Enable IP forwarding (useful for MITM attacks):

sysctl -w net.ipv4.ip_forward=1

Disable ICMP echo requests (block ping):

sysctl -w net.ipv4.icmp_echo_ignore_all=1

Reload configuration:

sysctl -p

Managing Kernel Modules

List installed modules:

lsmod

Show module information:

modinfo soundcore

Add a module:

modprobe -a <module-name>

Remove a module:

modprobe -r <module-name>

View kernel message buffer:

dmesg

Automating Tasks with Job Scheduling

The cron daemon checks the crontab for commands to run at specified times.

System-wide scheduling: /etc/crontab

Time specification formats:

• Range: 1-5
• List: 1,3,5

Edit your crontab:

crontab -e

Crontab Shortcuts

Special shortcuts for common schedules:

• @yearly or @annually
• @monthly
• @weekly
• @daily or @midnight
• @noon
• @reboot

Usage: @shortcut <user> <command>

Startup Scripts (RC)

When Linux boots, init runs scripts from /etc/init.d/rc to start services.

Runlevels:

• 0 – Halt the system
• 1 – Single-user/minimal mode
• 2-5 – Multiuser modes
• 6 – Reboot

Manage startup services:

update-rc.d <service-name> defaults
update-rc.d <service-name> disable|enable|remove

GUI alternative: rcconf

Python Scripting Basics

Install pip (Python package manager):

apt-get install python3-pip

Install packages from PyPI:

pip3 install <package-name>

Default install location: /usr/local/lib/<python-version>/dist-packages

Check installed package info:

pip3 show <package-name>

Install from source:

python setup.py install

Working with Modules

• Module: A module is code saved in a separate file for reuse.

To use a module, you must import it:

import module_name