50 Linux Commands for Cybersecurity Beginners

Linux is one of the most important operating systems to learn if you are interested in cybersecurity, ethical hacking, penetration testing, cloud computing, DevOps, or system administration.

Many security tools and server environments are based on Linux. Before learning advanced cybersecurity tools, it is important to understand files, directories, users, permissions, processes, networking, and system logs.

In this guide, you will learn 50 essential Linux commands for cybersecurity beginners, along with simple explanations and practical examples.

Security Note: Practice these commands only on your own computer, virtual machine, lab environment, or systems for which you have explicit permission to test.

Why Should Cybersecurity Students Learn Linux?

Cybersecurity is not only about using security tools. You also need to understand how operating systems work.

• Files and directories
• Users and groups
• File permissions
• Running processes
• Network interfaces
• Open connections
• System services
• Logs and events
• Shell commands and scripts

Once these fundamentals become comfortable, learning security tools becomes much easier.

50 Essential Linux Commands

1. pwd — Print Working Directory

The pwd command shows your current working directory.

pwd

Example output:

/home/student

This is useful when working with files and directories because it tells you exactly where you are.

2. ls — List Files

The ls command displays files and directories.

ls

For detailed information:

ls -l

To display hidden files:

ls -la

A useful beginner command is:

ls -lah

3. cd — Change Directory

The cd command changes your current directory.

cd /home

Move one directory back:

cd ..

Return to your home directory:

cd ~

4. mkdir — Create a Directory

The mkdir command creates a new directory.

mkdir cybersecurity

You can create multiple directories:

mkdir linux networking security

5. rmdir — Remove an Empty Directory

The rmdir command removes an empty directory.

rmdir test

6. touch — Create a File

The touch command can create an empty file.

touch notes.txt

You can create multiple files at once:

touch file1.txt file2.txt file3.txt

7. cat — Display File Contents

The cat command displays the contents of a text file.

cat notes.txt

8. less — Read Large Files

The less command lets you read large text files page by page.

less logfile.txt

Press q to exit.

9. head — View the Beginning of a File

The head command displays the first lines of a file.

head notes.txt

Display the first 20 lines:

head -n 20 notes.txt

10. tail — View the End of a File

The tail command displays the last lines of a file.

tail logfile.txt

To monitor a log file as new lines appear:

tail -f logfile.txt

Press Ctrl + C to stop.

11. cp — Copy Files

The cp command copies files and directories.

cp notes.txt backup.txt

Copy a directory:

cp -r project project_backup

12. mv — Move or Rename Files

The mv command can rename or move files.

mv old.txt new.txt

Move a file to another directory:

mv report.txt /home/student/Documents/

13. rm — Remove Files

The rm command removes files.

rm test.txt

Remove a directory recursively:

rm -r test

Warning: Be very careful with rm, especially recursive deletion. Always confirm what you are deleting before running a destructive command.

14. clear — Clear the Terminal

The clear command clears the terminal screen.

clear

15. history — View Previous Commands

The history command displays commands previously entered in the shell.

history

You can search the history for a specific command:

history | grep ssh

16. whoami — Show Current User

The whoami command displays the current username.

whoami

17. id — Show User and Group Information

The id command displays information such as your user ID, group ID, and group memberships.

id

18. passwd — Change a Password

The passwd command is commonly used to change a user's password.

passwd

Never share your password or authentication credentials with others.

19. sudo — Run an Authorized Command With Elevated Privileges

The sudo command allows an authorized user to execute a command with elevated privileges.

sudo apt update

Only use elevated privileges when necessary, and understand the command before executing it.

20. su — Switch User

The su command can switch to another user account when authentication and system permissions allow it.

su username

21. chmod — Change File Permissions

The chmod command changes the permissions of files and directories.

chmod 755 script.sh

To add execute permission:

chmod +x script.sh

Understanding permissions is important in cybersecurity because poor permissions can expose sensitive information.

22. chown — Change File Ownership

The chown command changes file ownership.

sudo chown student:student notes.txt

23. find — Search for Files

The find command searches for files and directories.

find /home -name "notes.txt"

Search for log files:

find /var/log -name "*.log"

Find regular files inside the current directory:

find . -type f

24. grep — Search Text

The grep command searches for text patterns inside files or command output.

grep "error" logfile.txt

Case-insensitive search:

grep -i "error" logfile.txt

Search recursively inside a directory:

grep -r "password" ./project

25. sort — Sort Text

The sort command sorts lines of text.

sort names.txt

26. uniq — Remove Repeated Lines

The uniq command removes adjacent duplicate lines. It is often combined with sort.

sort users.txt | uniq

27. wc — Count Lines, Words and Characters

The wc command counts lines, words, and characters.

wc notes.txt

Count only lines:

wc -l notes.txt

28. cut — Extract Parts of Text

The cut command extracts selected parts of lines.

cut -d: -f1 /etc/passwd

This example extracts the first field from colon-separated entries.

29. awk — Process Structured Text

awk is a powerful text-processing tool that is frequently used in Linux administration and scripting.

awk '{print $1}' names.txt

30. sed — Stream Editor

sed can process and transform text.

sed 's/old/new/g' file.txt

31. ps — View Running Processes

The ps command displays information about running processes.

ps aux

Understanding processes is important when investigating system behavior or troubleshooting performance.

32. top — Monitor Processes

The top command provides a live view of running processes and resource usage.

top

Press q to exit.

33. kill — Send a Signal to a Process

The kill command sends a signal to a process using its process ID.

kill 1234

Always verify the process ID before terminating a process.

34. df — Check Disk Space

The df command displays filesystem disk usage.

df -h

35. du — Check Directory Size

The du command shows how much disk space files and directories use.

du -sh Downloads

36. free — Check Memory Usage

The free command displays RAM and swap usage.

free -h

37. uname — Display System Information

The uname command displays kernel and system information.

uname -a

38. hostname — Display the Hostname

The hostname command displays the system hostname.

hostname

39. ip — Manage and Inspect Networking

The ip command is one of the most useful Linux networking commands.

View network addresses:

ip addr

View routing information:

ip route

View network link information:

ip link

40. ping — Test Network Reachability

The ping command can test network reachability using ICMP echo requests where supported.

ping example.com

Send a limited number of packets:

ping -c 4 example.com

41. ss — Inspect Network Sockets

The ss command displays socket information and can help you inspect listening network services.

ss -tuln

This is useful for understanding which services are listening on a Linux system.

42. curl — Test URLs and APIs

The curl command transfers data to or from URLs and is widely used for testing web servers and APIs.

curl https://example.com

Display HTTP response headers:

curl -I https://example.com

43. wget — Download Files

The wget command can download files from supported URLs.

wget https://example.com/file.zip

44. dig — Query DNS

The dig command is commonly used for DNS troubleshooting.

dig example.com

Query an A record:

dig example.com A

Query mail records:

dig example.com MX

45. nslookup — DNS Lookup

nslookup is another command for querying DNS information.

nslookup example.com

46. traceroute — Trace a Network Path

The traceroute command helps show the network path toward a destination.

traceroute example.com

Depending on your Linux distribution, traceroute may need to be installed before use.

47. ssh — Secure Remote Login

SSH stands for Secure Shell. It is widely used to remotely access Linux systems securely.

ssh username@192.168.1.10

Only connect to systems you own or have permission to access.

48. systemctl — Manage Services

The systemctl command is commonly used on systemd-based Linux systems to inspect and manage services.

Check a service:

systemctl status ssh

Start a service:

sudo systemctl start ssh

Restart a service:

sudo systemctl restart ssh

49. journalctl — Read System Logs

The journalctl command can be used to view logs collected by systemd's journal.

View recent logs:

journalctl -n 50

View logs for a service:

journalctl -u ssh

Log analysis is an important skill in troubleshooting and security investigations.

50. man — Read Command Documentation

The man command opens the manual page for many Linux commands.

man ls

For example:

man ip

Instead of memorizing every command, learn how to use the manual pages to understand syntax and available options.

Practical Linux Exercise for Beginners

You can safely practice several commands by creating a small local lab directory.

Step 1: Create a practice directory

mkdir cybersecurity-lab
cd cybersecurity-lab

Step 2: Create sample files

touch users.txt logs.txt notes.txt

Step 3: Add sample log entries

echo "admin login successful" > logs.txt
echo "failed login attempt" >> logs.txt
echo "admin login successful" >> logs.txt

Step 4: Read the log

cat logs.txt

Step 5: Search for login activity

grep "login" logs.txt

Step 6: Count the lines

wc -l logs.txt

This small exercise helps you understand how Linux commands can be combined for basic log analysis.

10 Linux Commands You Should Learn First

If you are completely new to Linux, start with these commands:

1. pwd
2. ls
3. cd
4. mkdir
5. touch
6. cat
7. cp
8. mv
9. grep
10. sudo

After that, move on to:

1. find
2. chmod
3. chown
4. ps
5. top
6. ip
7. ss
8. ping
9. curl
10. ssh

Linux Learning Path for Cybersecurity Students

A simple progression is:

Linux Basics → File System → Users & Permissions → Processes → Networking → Logs → Bash Scripting → Security Tools

Learning in this order gives you a stronger foundation than trying to memorize advanced commands without understanding the underlying concepts.

Common Mistakes Beginners Make

1. Memorizing commands without understanding them

Do not just memorize a command such as chmod 755 file. Understand what the permissions actually mean.

2. Using sudo unnecessarily

Administrative privileges should be used carefully because commands executed with elevated privileges can make system-wide changes.

3. Practicing on unauthorized systems

Security-related commands and tools should be used only in authorized environments.

4. Ignoring logs

System logs can provide valuable information for troubleshooting, monitoring, and security investigations.

How Long Does It Take to Learn Linux?

You do not need to memorize all 50 commands in one day.

A simple learning plan is:

• Week 1: Files and directories
• Week 2: Permissions and text processing
• Week 3: Processes and system administration
• Week 4: Networking and remote administration

After learning the basics, start practicing Bash scripting, networking, system logs, and security tools in an authorized lab.

Final Thoughts

Linux is one of the strongest foundations you can build before moving into cybersecurity.

The goal is not simply to memorize 50 commands. The real goal is to understand:

What the command does → Why you need it → What the output means

Practice regularly, build your own Linux lab, and gradually move from basic commands to networking, system administration, scripting, and cybersecurity tools.

Frequently Asked Questions

Is Linux necessary for cybersecurity?

Linux is not the only operating system used in cybersecurity, but Linux knowledge is highly valuable for servers, system administration, networking, security tools, and security labs.

Which Linux distribution should a beginner use?

Beginners can start with a general-purpose distribution such as Ubuntu or Linux Mint to learn Linux fundamentals. Security-focused distributions can be explored later.

Should beginners use Kali Linux immediately?

Kali Linux can be useful for security testing and security labs, but learning Linux and networking fundamentals first can make the experience much easier.

How many Linux commands should I learn?

There is no fixed number. Start with commonly used commands and learn additional commands when a practical task requires them.

Can I practice Linux on Windows?

Yes. You can use a virtual machine, WSL, or another legitimate Linux environment depending on your learning goals.

What should I learn after Linux?

A useful learning sequence is:

Linux → Networking → Bash → Web Fundamentals → Security Fundamentals → Security Tools → Practical Labs

Conclusion

These 50 Linux commands are a strong starting point for students, developers, system administrators, and cybersecurity beginners.

Bookmark this page and return to it while practicing Linux.

CodeWithAV Tip: Do not just read Linux commands. Open a terminal and practice them yourself.