The 10 Commands · lesson 4 · 2026-09-14

The 10 Linux Commands Every Security Beginner Uses in 2026

▶

Before you start

• A Kali Linux machine or VM (the commands are standard Linux tools; netstat comes from the net-tools package).
• A practice folder at /tmp/kali-home with Documents/notes.txt, scripts/backup.sh and logs/app.log to run the commands against: mkdir -p /tmp/kali-home/{Documents,scripts,logs} && cd /tmp/kali-home && printf 'Shopping list Todo: call Sam Wifi password: changeme Bank password: hunter2 Birthday: May 4 Backup at noon ' > Documents/notes.txt && printf '#!/bin/sh echo backup ' > scripts/backup.sh && seq 1 10 > logs/app.log.
• Only test systems you own or are authorized to test.

Ten ordinary commands are the toolkit every security beginner actually lives in — not fancy exploits, just knowing your way around a Linux terminal. Let’s run all ten, for real, right now.

We already have a terminal open, sitting in a folder full of ordinary files — nothing here is special or fake. Every command we run today, you could run on your own machine right now.

Command one. What is actually in this folder?

1 — List what’s in a folder

ls -la

ls is the single most-used command in Linux — it lists a folder’s contents. Add dash l for a detailed, one-per-line view, and dash a to reveal hidden files, the ones whose name starts with a dot that ls normally skips.

l s, space, dash l a, and press Enter.

A folder full of ordinary files and subfolders — including a couple of hidden ones you would have missed without dash a.

Command two. Move into one of those folders.

2 — Change your current folder

cd Documents

cd, short for change directory, is how you move around a Linux filesystem from the terminal instead of clicking through a file manager. Nothing prints back by default — the terminal just quietly starts you inside the new folder.

c d, space, Documents, and press Enter.

cd Documents && pwd

pwd there just proves where we landed — print working directory. We really are inside Documents now.

Command three. Read a file straight to the screen.

3 — Print a file’s contents

cat notes.txt

cat, short for concatenate, dumps a file’s full contents straight to your terminal. It’s the fastest way to read a short file without opening an editor.

c a t, space, notes dot text, and press Enter.

cat Documents/notes.txt

A short set of notes — and notice one line in there that’s about to matter for our next command.

Command four. Find one line out of many, instantly.

4 — Search inside a file

grep -i password notes.txt

grep searches text for a pattern and prints only the matching lines. Dash i tells it to ignore capitalization, so password and Password both match. On a real file with thousands of lines, this is how you find the one that matters.

g r e p, space, dash i, space, password, space, notes dot text, and press Enter.

grep -i password Documents/notes.txt

Out of the whole file, grep handed back exactly the line we actually cared about.

Command five. You know a file exists somewhere — find it.

5 — Locate a file by name

find . -name '*.sh'

find searches an entire folder tree, including every subfolder, for anything matching a pattern. The star is a wildcard, so star dot s h matches any file at all that ends in dot s h — a shell script.

find, space, dot, space, dash name, space, star dot s h, and press Enter.

Found it — one script, buried inside a subfolder, without us ever having to go look for it ourselves.

Command six. Linux won’t run a script until you tell it to.

6 — Change a file’s permissions

chmod +x backup.sh

Every file carries permissions controlling who can read it, write it, or execute it. A brand-new script isn’t executable by default — plus x adds exactly that one permission, and nothing else changes.

c h m o d, space, plus x, space, scripts slash backup dot s h, and press Enter.

chmod +x scripts/backup.sh && ls -l scripts/backup.sh

Look at the very front of that permissions string — an x has appeared where there wasn’t one before. This script can now actually run.

Command seven. What is this computer actually doing right now?

7 — List running processes

ps aux

ps lists every process currently running. The aux flags together mean show absolutely everything, for every user, not just your own terminal. We pipe it into head just to keep the list on screen.

p s, space, a u x, and press Enter.

ps aux | head -n 8

Every one of those lines is a real running program — this is exactly where you’d start looking if a machine felt slower than it should.

Command eight. Which doors on this machine are actually open?

8 — List network connections

netstat -tuln

netstat lists network activity. Dash t and dash u ask for TCP and UDP together, dash l narrows it to ports that are actively listening for a connection, and dash n prints port numbers instead of trying to resolve names — which is also faster.

netstat, space, dash t u l n, and press Enter.

netstat -tuln | head -n 8

Every listed port is a service on this machine waiting for someone to connect to it — and on a real security review, that list is one of the first things you check.

Command nine. Is this machine about to run out of room?

9 — Check disk space

df -h

df, short for disk free, reports how much space is used and available on every mounted drive. Dash h prints those sizes in gigabytes and megabytes instead of raw byte counts, which is what human-readable actually means.

d f, space, dash h, and press Enter.

Every filesystem this computer has mounted, and exactly how full each one is.

Command ten. Skip to the newest entries in a file that keeps growing.

10 — Watch the end of a file

tail -n 5 app.log

Log files can run for thousands of lines, and the newest entry is always at the bottom. tail jumps straight to the end, and dash n five limits it to exactly the last five lines instead of printing the whole file.

tail, space, dash n five, space, logs slash app dot log, and press Enter.

tail -n 5 logs/app.log

The five most recent entries in that log — including the one at the very bottom that you’d actually want to notice first.

Ten commands, and every one of them earns its place in daily security work.

The 10 in order

• ls, cd → see and move around a folder
• cat, grep, find → read, search, locate files
• chmod → control who can run what
• ps, netstat → what’s running, what’s listening
• df, tail → disk space and live logs

List what’s there, move around, read a file, search inside it, and locate one you can’t see. Control whether a file is even allowed to run. Check what the machine is doing and what it’s listening for. Watch how full the disk is, and watch a log grow in real time.

None of this needed a single exploit — it’s the exact toolkit you reach for before anything else, on any Linux machine you’ll ever touch.

And one habit that matters more than any single command here.

Before you go

• Practice these ten on your own machine, today
• Combine them: grep a file you found with find
• New to the terminal? Start with our beginner course, linked below
• Next week: 10 more commands, a different corner of security

The fastest way to actually learn these is to run them yourself, right now, on your own machine. Once they feel automatic, start combining them — searching a file you just located with find, or watching a log you just discovered with tail.

If any of this moved too quickly, our beginner course starts from opening the terminal for the very first time, and it’s linked below. Thanks for learning with The Exploit HQ, and I’ll see you in the next one.