# Navigation & Info
pwd # current directory
ls -lah # list files with hidden, sizes
ls -la /etc | grep conf # filter config files
cd /var/log # go to log directory
cat /etc/passwd # user accounts
cat /etc/os-release # OS info
uname -a # kernel version
id # current user + groups
whoami # username
groups # group memberships
hostname -I # IP addresses
# File & Text Operations
find / -name "*.conf" 2>/dev/null # find config files
find /var -mtime -1 2>/dev/null # files modified in last 24h
grep -ri "password" /etc 2>/dev/null # search for "password" text
grep -n "failed" /var/log/auth.log | tail -20
sed -n '100,200p' /var/log/syslog # print lines 100-200
2. Network Discovery (Lab/Own Subnet Only)
# Interface info
ip addr # all interfaces + IPs
ip route # routing table
ip neigh # ARP cache (neighbors)
ss -tulpen # TCP/UDP open ports + processes
ss -tulpen | grep LISTEN # listening services
netstat -tlnp # older alternative
# Ping sweep (discover live hosts) — own lab only
nmap -sn 192.168.56.0/24 # host discovery (no port scan)
nmap -sn 10.0.0.0/24
# Port scanning — own machines only
nmap -sV 192.168.56.10 # version detection
nmap -O 192.168.56.10 # OS fingerprinting
nmap -sV -sC 192.168.56.10 # version + default scripts
nmap -p 22,80,443,3306,5432 192.168.56.10 # specific ports
nmap -A 192.168.56.10 # aggressive: OS + version + scripts
# Service scan output interpretation
# STATE: open / closed / filtered
# 22/tcp open ssh OpenSSH 8.9p1 Ubuntu
# 80/tcp open http Apache httpd 2.4.52
3. DNS, Packet, & Traffic Analysis
# DNS Lookups
ping google.com
traceroute google.com # path to host
dig google.com # DNS A record
dig google.com MX # mail servers
dig @8.8.8.8 google.com # use specific DNS resolver
whois google.com # domain registration info
nslookup google.com
# Packet capture (read-only, own traffic)
sudo tcpdump -i eth0 -nn # all traffic
sudo tcpdump -i eth0 port 80 # HTTP only
sudo tcpdump -i eth0 port 53 # DNS only
sudo tcpdump -i eth0 host 192.168.1.1 # specific host
sudo tcpdump -i eth0 -w capture.pcap # save to file
wireshark capture.pcap # open in GUI
4. Web App Lab Scanning (DVWA/WebGoat Only)
# Nikto — web server vuln scanner (lab targets only)
nikto -h http://192.168.56.10
nikto -h http://192.168.56.10 -port 8080
# WhatWeb — fingerprint tech stack
whatweb http://192.168.56.10
# Curl — manual request inspection
curl -I http://192.168.56.10 # headers only
curl -v http://192.168.56.10/admin # verbose
curl -X POST http://192.168.56.10/login \
-d "username=admin&password=test"
# Dirb — directory bruteforce (lab only!)
dirb http://192.168.56.10 /usr/share/wordlists/dirb/common.txt
# Authentication logs — look for failed logins
sudo cat /var/log/auth.log | grep "Failed password"
sudo tail -f /var/log/auth.log # live watch
sudo journalctl -u ssh --since "1 hour ago"
sudo journalctl -xe # recent system errors
# Who logged in?
last # successful logins
lastb # failed login attempts
who # currently logged in users
w # users + what they're doing
# Failed login count per IP
sudo grep "Failed password" /var/log/auth.log | \
awk '{print $11}' | sort | uniq -c | sort -rn | head -20
# UFW Firewall (Ubuntu)
sudo ufw status verbose
sudo ufw allow 22/tcp # allow SSH
sudo ufw enable
6. Privilege & Process Info
# Running processes
ps aux # all processes
ps aux | grep nginx # find specific process
top # live process monitor
htop # prettier alternative
# Open files / network by process
sudo lsof -i :80 # what's using port 80
sudo lsof -i :443
sudo lsof -u www-data # files opened by user
# Sudoers & privilege check
sudo -l # what can current user sudo
cat /etc/sudoers # sudo config (root only)
# SUID binaries (potential privesc — CTF/lab context)
find / -perm -4000 2>/dev/null # files with SUID bit set
find / -perm -2000 2>/dev/null # SGID files