Graphical tools are fine for a first look, but they stop being useful the moment you need to filter forty thousand log lines, confirm what a binary really does, or prove that a port is open on a specific interface. That work happens in a shell.
What follows isn't a ranked list of favourites. It's a working set: the commands that show up in nearly every assessment, whether you're triaging files pulled off a compromised host, mapping a lab network, or hunting for a path from a low-privileged account to root. Everything here is safe to run on systems you own. For anything else, get written authorisation first — that is the line between an ethical hacker and a trespasser.
find walks a directory tree and reports what matches. The syntax feels odd for about a week and obvious afterwards. Four forms worth memorising:
file tells you what something actually is, regardless of its extension: file payload.bin. strings pulls readable text out of a binary, and strings -n 8 image.bin | less keeps only sequences of eight characters or more, which cuts the noise considerably. sha256sum gives you a fingerprint: run sha256sum evidence.img before you analyse anything, then compare it against the vendor's published value. If the hashes differ, stop and find out why before you go further.
Most log analysis is a pipeline rather than a single command. Read it left to right and each stage narrows the result:
grep -i "failed password" /var/log/auth.log | grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' | sort | uniq -c | sort -nr | head
That answers a real question — which addresses are failing to log in, and how often. The flags matter: -i ignores case, -v inverts the match, -c counts lines, -r recurses through a directory, -o prints only the matching part, and -E enables extended regular expressions so (error|fail|denied) works without escaping every bracket.
Two habits pay off. Pipe long output through less so you can search inside it. And test your pattern against a small sample first; a regex that matches too much is worse than no filter, because it looks like an answer.
ss replaced netstat on modern distributions and runs faster. ss -tulpn shows listening TCP and UDP sockets with the owning process and PID attached — you'll usually need sudo for that last column. ss -tan state established shows what's currently connected. When a port is busy and you don't know why, lsof -i :8080 names the process holding it, which turns a twenty-minute mystery into a two-second fix.
curl reads services the way they actually respond. curl -I https://example.com fetches headers only. curl -s -o /dev/null -w "%{http_code}\n" http://10.0.0.5/ prints nothing but the status code, handy when you're checking a list of hosts. The -k flag, which ignores certificate errors, belongs in a lab and nowhere else: it hides exactly the problem you'd want to catch in production.
Guessing what a service is doing is slower than watching it. tcpdump -i eth0 -nn port 80 captures HTTP traffic on one interface, with -nn suppressing DNS and port-name lookups so the output stays readable.
For anything beyond a quick glance, write to a file: sudo tcpdump -i any -w capture.pcap. You can reopen that in Wireshark later, when you're not under time pressure and can follow a stream properly. Add -c 50 so a forgotten capture doesn't fill your disk, or -A to print payloads as ASCII when you want to read them in the terminal.
Filter early. "host 10.0.0.5 and not port 22" keeps your own SSH session's traffic out of the capture — which matters when you're connected across the network you're capturing.
Start with nmap -sn 10.0.0.0/24 to see which hosts are alive. Then scan a single target rather than the whole subnet; it's kinder to the network and far easier to interpret.
nmap -sV -sC 10.0.0.5 probes the thousand most common ports, fingerprints the services and runs a set of default scripts. Adding -p- scans all 65,535 ports, which takes a long time — save it for targets that matter. -T4 speeds things up on a responsive network; pushing timing higher than that mostly produces false negatives.
Read the output rather than trusting the summary line. An open port running a version you don't recognise is more interesting than a clean scan.
Privilege escalation on a Linux host is mostly enumeration. You're looking for something misconfigured, and this ordered checklist is where that search starts. Run it on a machine you own:
Photo: 422737 / Pixabay
