Linux in the Terminal for AppSec and Pentest: The Bare Minimum, No Fluff

Related: learn penetration testing, stages of penetration testing, who is a pentester, how to become an Application Security Engineer, mentoring.

Beginners keep running into the same problem: someone installs Kali Linux, downloads dozens of tools, launches a training machine, and immediately gets lost. It is unclear where a service's config file lives, how to check running processes, exactly which process is listening on a network port, and how to read a file's permissions. The result is a chaotic search for tools, when the problem is purely a lack of basic orientation in the operating system.

To work successfully in pentest and Application Security (AppSec), the Linux terminal is needed daily. Even if your main specialization is testing web applications and APIs, at some point you get access to a server or container and must quickly gather the context of the environment.

1. Kali Linux, Parrot OS, or plain Debian/Ubuntu

Kali Linux and Parrot OS are standard Debian-based distributions that come with a set of specialized software preinstalled. However, the mere fact of installing Kali does not make a person a specialist.

The main skill is the ability to orient yourself on an unfamiliar system regardless of the graphical shell and preinstalled software. Trying to solve every task by launching third-party scanners without understanding the internals of Linux leads to wasted time.

Self-check of your basics

Take a clean install of Ubuntu or Debian without preinstalled security tools and check whether you can do the following:

• Find the config files of a service you care about in the /etc directory.
• Decode a symbolic permission string (for example, rwxr-xr-x).
• Determine exactly which process, and under which account, is listening on a local network port.
• Filter a service's logs using standard CLI utilities.
• Make an HTTP request with curl, capture the headers, and save the result to a file.

If these actions are automatic, working through practical labs (Hack The Box, TryHackMe, local ranges) will go without extra delays.

2. Navigation and the filesystem

Every working session on a host should start by gathering basic context: determining your current location, the permissions of the current account, and the environment.

pwd        # Show the current working directory
ls -la     # List all files, including hidden ones, with detailed permissions and owners

Hidden files and important directories

Pay special attention to hidden files and directories (those starting with a dot). They often contain credentials, command history, and access keys:

• .env — config files with passwords and API tokens.
• .bash_history, .zsh_history — the command history of previous users.
• .ssh/ — private keys, known hosts, and the authorized keys file (authorized_keys).

Basic CLI commands

Standard utilities are used to analyze files: cd, cat, less, head, tail, file.

Searching for config files without printing access errors:

find /home -type f -name "*.conf" 2>/dev/null

The redirect 2>/dev/null discards Permission denied messages, leaving only the relevant output.

Always check the map of users in /etc/passwd:

cat /etc/passwd

Each line contains: the username, the encrypted password (x), UID, GID, a description, the home directory, and the login shell.

Checking your own account:

whoami    # Current username
id        # UID, GID, and group list
groups    # Groups the current user belongs to

3. Permissions, the SUID bit, and sudo

Permission separation in Linux is based on three categories of subjects: Owner, Group, and Others.

The ls -l command prints permissions as a symbolic string:

-rwxr-xr-- 1 root www-data 4096 Aug 11 12:00 script.sh

• r (read) — reading a file / listing the contents of a directory.
• w (write) — modifying a file / creating and deleting files in a directory.
• x (execute) — running a file / entering a directory.

Permissions and owners are changed with the chmod and chown commands. Applying chmod 777 to executable scripts or configs is a critical misconfiguration, since it gives write access to absolutely every user in the system.

The SUID bit (Set User ID)

SUID is a special permission flag. If it is set on an executable file, the program runs with the permissions of the file's owner (often root), not those of the user who invoked it.

Searching for files with the SUID bit set:

find / -perm -4000 -type f 2>/dev/null

Checking sudo rights

The sudo -l command shows exactly which commands the current user can run as root or other users, with or without a password:

sudo -l

Analyzing this command's output lets you determine whether legitimate privilege escalation or administrative tasks are possible.

4. Processes, services, and system logs

To understand the state of the system, you need to track active processes and services.

Process analysis

ps aux    # Full list of running processes with users and arguments
ps -ef    # Alternative process tree output format

When analyzing processes, pay attention not only to the program's name, but also to the user it runs as, and to the arguments passed (they may contain passwords and startup keys).

Managing services (systemd)

systemctl status <service_name>         # Check the status of a specific service
systemctl list-units --type=service     # List all active services

Reading logs

Analyzing logs helps you understand the system's behavior and find traces of services at work:

• journalctl -u ssh — viewing the logs of a specific service through systemd.
• /var/log/auth.log (or /var/log/secure) — authentication and login attempt logs.
• /var/log/nginx/ or /var/log/apache2/ — access and error logs of web servers.

Using grep and less lets you narrow the selection to the events you need:

grep -i "error" /var/log/nginx/error.log | less

5. Network diagnostics from the terminal

A pentester and AppSec engineer must be able to quickly assess a host's network state from the inside.

Checking network interfaces and routes

ip a    # List of network interfaces and IP addresses
ip r    # Routing table

Analyzing open sockets and ports

The ss utility (the modern equivalent of netstat) is used to check listening ports:

ss -tulpn

• -t — TCP sockets
• -u — UDP sockets
• -l — listening ports only
• -p — show the PID and process name
• -n — show ports as numbers rather than service names

This lets you instantly spot services that sit on 127.0.0.1 (localhost) and are not reachable from the outside network.

Interacting with web services via curl

curl -I https://example.com                 # Get only the HTTP response headers
curl -i -X POST -d "param=value" http://target/api  # POST request with data
curl -k -L https://target                   # Ignore SSL errors and follow redirects

To check how DNS works, use the dig or nslookup utilities:

dig A example.com +short

6. Bash basics

Complex scripts are not required at the start, but you must be fluent with pipes and stream redirection.

Stream redirection and pipelines

• | (pipe) — passes the standard output (stdout) of the first command to the standard input (stdin) of the second.
• > — redirects output to a file, overwriting it.
• >> — appends output to the end of a file.
• 2>/dev/null — suppresses the standard error stream (stderr).

An example combination:

cat access.log | grep "POST" | awk '{print $1}' | sort | uniq -c | sort -nr

This pipeline extracts the IP addresses that made POST requests, counts them, and sorts them in descending order.

Loop constructs

A simple for loop to run checks in sequence:

for ip in $(cat targets.txt); do curl -s -I "http://$ip" | head -n 1; done

7. A four-week hands-on learning plan

8. Common beginner mistakes

• Replacing basic knowledge with tool installs: downloading a hundred utilities from the Kali menu without being able to read a config file by hand.
• Passively watching tutorials: reading articles and watching videos without running the commands in the terminal at the same time.
• Not keeping notes: running checks without recording the commands executed, the file paths, and the results obtained.
• Ignoring the error stream: ignoring system output messages when commands fail instead of analyzing the cause (lack of permissions, a wrong path, a missing binary).
• Blindly copying other people's scripts: running complex Bash/Python scripts on the target system without understanding what they do.

9. Training and contact

If you need systematic preparation in Application Security and hands-on pentest (including working with Linux, Web/API, and producing professional reports), see the details of the program on the Application Security Engineer page.

An individual preparation plan for your current background (QA, development, system administration) can be discussed on WhatsApp. The format is described in detail in the cybersecurity mentoring section.

Also: learn penetration testing, stages of penetration testing, who is a pentester, how to become an Application Security Engineer, mentoring.