Ethical Hacking Series: Command-Line Tools
Watch a demo of a “hacking tool” with a slick graphical interface and you might think that is how the job is done. It is not. Real security work happens in a terminal, a plain window where you type commands and read text. The graphical tools have their place, but the moment you need to move fast, combine tools, or automate something, you are at the command line, and everyone who is good at this is fluent there.
This is the first stop in the ethical hacking series for a reason: nearly everything else assumes you can find your way around a terminal. If you cannot yet, that is completely fine: this guide covers the tools and commands that actually come up in day-to-day work, with real examples of why you would reach for each one. Not a reference dump; the working set.
Everything here is standard Linux. You do not need a special distribution, though Kali comes with the security tools already installed if you want the convenience.
Why the terminal wins
Three reasons the command line beats clicking, and they are worth internalising because they shape how you work.
Speed and precision come first. A command does exactly what you tell it, instantly, with no menus to navigate. Once your fingers know the commands, you move faster than any mouse could.
Composability is the big one. Small command-line tools can be joined together, the output of one feeding straight into the next. That means you are not limited to what any single tool’s designer imagined: you build your own workflows by combining pieces. Nothing in the graphical world matches this.
Automation is the third. Anything you can type, you can save as a script and run a thousand times. Repetitive work, such as scanning a list of hosts, processing results, or checking things on a schedule, gets automated away. The terminal is the gateway to that.
Keep those three in mind and the commands below stop being arbitrary trivia and start being obvious tools for obvious jobs.
Getting around: the navigation basics
You cannot do anything until you can move through the filesystem confidently. These are the commands you will type more than any others, thousands of times, until they are pure reflex.
pwd: print working directory. Tells you where you are. You will use it constantly when you lose track.ls: list the contents of the current directory. Add-la(ls -la) to see everything, including hidden files and permissions. Hidden files, the ones starting with a dot, are where interesting configuration and credentials often hide, so-lais the version you actually want.cd: change directory.cd /var/wwwmoves you there;cd ..moves up one level;cdalone takes you home.cat: dump the contents of a file to the screen. The quickest way to read a config file, a wordlist, or the flag you just captured.
None of this is exciting, and all of it is essential. Spend a week making Linux your daily environment and this becomes invisible: you stop thinking about navigation and start thinking about the actual task.
Searching: finding the needle
A huge part of security work is finding something specific in a large amount of data: a password in a pile of config files, a particular file on a system, one interesting line in a thousand lines of output. Three tools do this, and knowing which is which saves real time.
grep searches inside files. This is one of the most-used tools in all of security. It searches text for lines matching a pattern. Looking for anything that mentions a password across a directory of files:
grep -r "password" /var/www/The -r searches recursively through subdirectories. grep is how you pull the signal out of noise, and you will use it endlessly: on files, on command output, on everything.
find locates files by their properties. Where grep looks inside files, find looks for files, by name, size, date, type, or permissions. Finding every .conf file on a system:
find / -name "*.conf" 2>/dev/nullThe 2>/dev/null quietly throws away the “permission denied” errors so you only see real results. find is powerful because it can also act on what it finds, but even the basic search is something you will reach for daily.
locate is the fast filename lookup. It searches a pre-built database of filenames, so it is nearly instant, but it can be slightly out of date. When you just want to know “where is that file” and you know part of its name, it is the quickest option.
Content lives in grep; files live in find; speed lives in locate. That is the whole distinction.
Piping: where it all comes together
The idea that turns a handful of simple tools into something genuinely powerful is this: the vertical bar character, |, takes the output of one command and feeds it as the input to the next. This is called piping, and it is the soul of the Linux command line.
An example that shows the point. Suppose you want to know how many .php files are in a directory. No single command does exactly that, but you can build it:
ls -la | grep ".php" | wc -lRead it left to right: ls -la lists everything, the pipe hands that list to grep ".php" which keeps only the lines mentioning PHP files, another pipe hands those to wc -l which counts the lines. Three small tools, each doing one simple thing, combine into an answer none of them could give alone.
This is the mental shift that separates command-line beginners from people who are fluent. You stop looking for the one perfect tool and start building the tool you need out of small pieces. Every serious workflow in security (chaining a scanner into a filter into a processor) is this idea scaled up. It is exactly how the output of ffuf or an enumeration scan gets sifted down to the few results that matter.
Shaping text: the processing tools
Piping is only as useful as your ability to reshape what flows through it. Security work produces mountains of text (scan output, URL lists, log files) and a small family of tools turns that raw text into exactly what you need. These pair with grep and pipes constantly.
sort: put lines in order, and withsort -u, remove duplicates while doing it. Essential when you have merged output from several tools and need one clean list.uniq: collapse or count repeated lines (usually paired withsortfirst).sort file | uniq -ctells you how many times each line appears, a quick way to spot patterns.cut: slice columns out of structured text. If each line ishost:port:service,cut -d: -f1pulls out just the hosts.awk: the heavier tool for column work and light logic. It can filter, reformat and calculate across columns, and even a tiny bit of awk (awk '{print $1}'to grab the first field) saves enormous manual effort.sed: find-and-replace on a stream. Swapping text, stripping characters, or reformatting URLs in bulk is a one-liner.tr: translate or delete characters, handy for things like turning commas into newlines.
You do not need to master all of these at once. Learn sort -u and cut first, since they cover most day-to-day needs, and pick up awk and sed as specific problems demand them. Combined with piping, these tools let you take the messy output of one program and hand the next program exactly the clean input it expects. That is the difference between fighting your tools and flowing through them.
Moving data around: networking from the terminal
Security is about networked systems, so pulling data over the network from the command line is essential. Two tools cover most of it.
curl talks to web servers directly. It sends HTTP requests from the terminal and shows you exactly what comes back: no browser, no rendering, just the raw response. Fetching a page’s headers to see what a server reveals about itself:
curl -I https://example.comThe -I requests just the headers. curl is how you interact with APIs, test endpoints, and inspect exactly what a server sends without a browser tidying it up. It is indispensable for web work, and it pairs naturally with reading security headers and understanding how HTTP really behaves under the hood.
wget downloads files. Where curl is for interacting, wget is for grabbing. Downloading a file or mirroring content:
wget https://example.com/file.zipSimple, reliable, and exactly what you want when you need to pull a wordlist, a tool, or a target file onto your machine.
Between them, curl and wget handle almost everything you need to move data over the network by hand.
Reading the room: system and process commands
When you are on a system, whether it’s your own, a lab machine, or an authorised target, you need to understand what is happening on it. A few commands answer the obvious questions:
ps aux: show every running process. What is this machine actually doing? What services are alive?netstat -tulpn(or the newerss -tulpn): show what is listening on the network. Which ports are open from the inside, and what is behind them? This is the local view of the same picture you build remotely during service enumeration.whoamiandid: who am I, and what am I allowed to do? The first thing to check after landing on a system, because your privileges decide what is possible next.
These are how you orient yourself. Land somewhere unfamiliar and this small set tells you where you are and what you are working with.
Automating: the payoff
Once you are comfortable typing commands, the natural next step is to stop typing the same ones over and over. Anything you can type, you can save in a file and run as a script.
You do not need to become a programmer. Being able to write a simple loop, such as “do this for every host in this list”, and save a sequence of commands as a reusable script will speed up your work more than almost anything else. Bash, the default shell on most Linux systems, handles this directly. Combined with the piping idea from earlier, a few lines of Bash can automate work that would take an hour by hand.
This is where the command line stops being a place you type and becomes a place you build. It is also the on-ramp to Python, which picks up where Bash gets awkward, and which is worth learning next, as covered in the free-resources roadmap.
One more habit: keep long jobs alive
Some tasks (a full port scan, a big content-discovery run) take a long time, and losing one because a connection dropped or you closed the laptop is painful. A terminal multiplexer like tmux (or the older screen) lets you start a job in a session that keeps running even after you disconnect, then reattach to it later exactly where it was. On any remote or long-running work it is close to essential, and learning the handful of tmux basics early will save you a lost scan more than once.
How to actually get good at this
The honest answer is unglamorous: use Linux for real, every day. No course will make the command line second nature. Living in it will.
Make a Linux system your daily environment for a month. Force yourself to do ordinary things, moving files, reading documents, searching for things, from the terminal instead of a graphical file manager. It will be slower and slightly annoying at first. Then, somewhere around week three, it clicks, and you realise you are reaching for the terminal without thinking because it is genuinely faster. That is the moment you have arrived.
Do not try to memorise everything. Learn the working set above, understand the concepts behind them (navigation, searching, piping, moving data) and look up the rest when you need it. man <command> gives you the manual for anything, right there in the terminal, and the GNU Bash manual is the authoritative reference for the shell itself. For curl, which you will use constantly against web targets, the curl manpage is worth reading properly once. If you are working on a machine where you have landed a shell, GTFOBins documents which ordinary binaries can be turned to unexpected purposes.
The command line is the foundation the whole rest of the series stands on: enumerating services, cracking passwords with Hydra, running ffuf: all of it is typed here. Get fluent, and everything else gets easier. If you would rather learn it hands-on with someone guiding you, that is exactly what our training covers from the ground up.
