Files & Navigation

You can't do anything useful in a terminal if you can't move around and manage files - and a surprisingly large portion of real security work is exactly that: finding things, moving things, and understanding what's where.

Where Am I? - pwd

pwd (print working directory) tells you your current location in the filesystem. Run it when you're disoriented.

Simple, but you'll use it constantly - especially after cd-ing through several directories and losing track.

Listing Files - ls

ls lists directory contents. On its own it's fine; with flags it becomes essential.

The key flags:

Changing Directory - cd

Essential shortcuts:

cd - is incredibly useful when you're jumping between two directories repeatedly - bouncing between /etc/ssh and /var/log while investigating, for example.

Copying Files - cp

cp source destination

Key flags:

• -r - recursive, required to copy directories
• -p - preserve timestamps, ownership, and permissions
• -i - interactive, asks before overwriting (good habit)
• -v - verbose, shows what's being copied

Moving and Renaming - mv

mv both moves files and renames them. It's the same command:

mv oldname newname        # rename in same directory
mv file.txt /tmp/         # move to /tmp/
mv file.txt /tmp/new.txt  # move AND rename

Unlike cp, mv doesn't leave the original behind. It also has -i for interactive mode and -v for verbose.

Deleting Files and Directories - rm

This is where people cause themselves real pain. rm is permanent - Linux has no Recycle Bin by default.

rm file.txt            # delete a single file
rm -r directory/       # delete a directory and everything inside it
rm -f file.txt         # force delete (no error if file doesn't exist)
rm -rf directory/      # force recursive delete - THE DANGER COMMAND

The -i flag (interactive) on rm -ri asks before deleting each item. Slower, but safer when you're not 100% sure of what's there.

Creating Directories - mkdir

mkdir dirname                  # create one directory
mkdir -p path/to/nested/dir    # create all intermediate directories
mkdir -m 700 private_dir       # create with specific permissions

The -p flag is invaluable for creating organized pentest directory structures without multiple commands.

Creating Empty Files - touch

touch was designed to update a file's timestamp, but its most common use is creating empty files:

touch newfile.txt              # create empty file (or update timestamp if exists)
touch file1.txt file2.txt      # create multiple files

In security work, touch is often used in scripts to create marker/lock files, or to update timestamps to hide when files were modified.

Finding Files - find

find is one of the most powerful commands for security research. It searches the filesystem with flexible criteria:

find [where] [what] [action]

That last command - find / -perm -4000 - finds SUID files. We'll dig into what SUID means in the Permissions lesson, but this is one of the first commands run during privilege escalation research.

Common find patterns for security work:

# Find world-writable directories
find / -type d -perm -o+w 2>/dev/null
 
# Find files modified in the last 10 minutes (find recent changes/uploads)
find / -type f -mmin -10 2>/dev/null
 
# Find files owned by root that are world-readable
find / -user root -perm -o+r -type f 2>/dev/null
 
# Find config files that might contain credentials
find / -name "*.conf" -o -name "*.config" -o -name "*.cfg" 2>/dev/null | head -20
 
# Find all files containing a string (combine with grep)
find /var/www -type f -name "*.php" -exec grep -l "password" {} \;

The 2>/dev/null at the end suppresses "Permission denied" errors. Without it, find floods your terminal with errors when it tries to enter directories you can't read.

Faster File Location - locate

locate is faster than find because it searches a pre-built database (updated daily via updatedb):

locate passwd            # find all paths containing "passwd"
locate -i readme         # case-insensitive
updatedb                 # update the database (run as root)

The downside: locate won't find files created after the last updatedb run. For recently created files, use find.

Finding Binaries - which and whereis

which python3            # show the full path of a command
which nmap
whereis nmap             # find binary, source, and man page locations

which is essential for understanding which version of a tool you're running when multiple versions are installed, and for verifying that a tool is in your PATH.

Wildcards and Globbing

The shell expands special characters before passing them to commands. This is called globbing (or filename expansion):

That last example - cp /etc/{passwd,shadow,group} /tmp/ - copies three files in one command using brace expansion. This is a common pattern in scripts and one-liners.

Putting It Together: Recon One-Liner

Here's a realistic snippet you might use immediately after getting a shell on a target:

# Quick situational awareness after gaining shell access
pwd && whoami && id
ls -la ~
ls -la ~/.ssh/ 2>/dev/null
find /home -name "*.txt" -o -name "*.cfg" -o -name "*.conf" 2>/dev/null | head -20
find / -perm -4000 -type f 2>/dev/null

Each of these commands is something you've now learned. That's how fast knowledge compounds in the terminal.

Key Takeaways

• pwd shows where you are; cd moves you around. cd - toggles between two locations.
• ls -la is the most useful variant - shows permissions, hidden files, owners, and sizes.
• cp copies, mv moves/renames, rm deletes - and rm is permanent with no undo.
• mkdir -p creates nested directories in one shot; touch creates empty files.
• find is the power tool for security recon: find SUID files, world-writable dirs, recently modified files, and config files containing credentials.
• which locates binaries in your PATH; locate searches a cached index quickly.
• Wildcards (*, ?, [], {}) let the shell expand patterns before commands run - master them to work efficiently.