Practical Linux Tricks for the Aspiring Hacker

^c # Duh. https://xkcd.com/416/
^d # Exit / EOF.

^r
^s

[ 1 -eq 1 ] && echo 'true' || echo 'false'
true

reset

. ~/.zshrc
source ~/.zshrc

tree

echo "$((1+1))" "$SHELL"
2 /bin/zsh
echo '$((1+1))' '$SHELL'
$((1+1)) $SHELL

echo $'...'

Example

Multi-Line Strings.

echo $'1\n2\n3'
1
2
3

Find words containing 't in comma-separated line.

echo -n $'can\'t,don\'t,I\'ll,I\'m,won\'t' | awk -vRS=, $'$0 ~ /\'t/'
can't
don't
won't

Examples

Retry with sudo.

mkdir /var/tmp/lol
Permission denied.
sudo !!
→ sudo mkdir /var/tmp/lol
Success!

Found an interesting directory, but forgot to cd.

ls long/path
cd !$
→ cd long/path

Rename file in folder from file.txt to booyah.md.

cat long/path/file.txt
mv "!$" "$(dirname !$)/booyah.md"
→ mv long/path/file.txt long/path/booyah.md

< out.txt # Read from file (to stdin).
> out.txt # Write to file (from stdout).
>> out.txt # Append to file (from stdout).
2> out.txt # Write to file (from stderr).
&> out.txt # Redirect all output.
&> /dev/null # Redirect everything into the void.
2>&1 # Redirect stderr to stdout.
>& # Same as `&>`.

Cut third field.
awk '$0=$3'

Print third field. (Pretty much same as the command above.)
awk '{print $3}'

Use ',' as field delimiter, e.g. for CSVs.
awk -F, '{print $3}'

Or use the script variable `FS` (Field Separator).
awk -v FS=, '{print $3}

seq 1 4 | awk '$1 % 2 == 1'
1
3
echo $'foo1\nbar1\nfoo2' | awk '$0 ~ /^foo/'
foo1
foo2

Add 5 to the first arg, then print the line.
awk '{$1 += 5}1'

seq 1 3 | awk '{$1 += 5}1'
6
7
8

awk '{print "booyah",$1,"yahoo"}'
awk also has variables, if, for, while, arrays, etc.

-i # case-insensitive
-E # regex
-v # non-match (inVert)

grep -rnw /path/to/somewhere/ -e 'pattern'

-P <n> # max procs
-n <n> # num args
-I {}  # pattern to insert into command

Examples

Combine multiple lines into 1 line.

echo $'1\n2\n3'
1
2
3
echo $'1\n2\n3' | xargs 
1 2 3

Multi-Processing: Execute ./do-something-to-file.sh <file> on multiple files, with at most 4 processes.

cat files.txt | xargs -P 4 -n1 ./do-something-to-file.sh

Multi-Processing: Port Scan with Ports 1-1000 through proxychains.

seq 1 1000 | xargs -P 50 -I{} proxychains4 -q nmap -p {} -sT -Pn --open -n -T4 --oN nmap.txt --append-output 192.168.101.10

basename ~/.bashrc
.bashrc
dirname ~/.bashrc
/home/trebledj

pushd # Push current directory, for easier returning.
popd  # Return to directory on top of stack.
dirs  # List history of dirs.

pushd/popd Example

cd ~/a/b/c
pushd deep/nested/directory
Jump to `deep/nested/directory`, push `~/a/b/c` into the stack.
cd ../../jump/around/some/more
cd ../../and/a/little/more
popd  # Return to `~/a/b/c`.

h

less file.txt

Renders ANSI colors.
less -R file.txt

Pager search becomes case insensitive.
less -I file.txt

Line numbers.
less -N file.txt

j # Line down.
k # Line up.
f # Page down.
b # Page up.
d # Half-page down.
u # Half-page up.
g # Go to start of file.
G # Go to end of file.
<n> g # Go to nth line.
# Go to the n% line of the file.
<n> p
20p 40p 50p 80p
# What's the current line?
^g

# Search (regex enabled).
/ <pattern>
# For case-insensitive search, use `less -I`.
# Navigate search results: next/prev result.
nN
# Filter lines by search.
& <pattern>
# Filter NON-MATCHING lines
& ! <pattern>
# Clear filter.
& <enter>

# Continuous feed (e.g. for streams of data)
F

# Next file.
:n
# Previous file.
:p

^z # Push process to background (and pause it).
bg # Start background process.
fg # Bring most recent background process into foreground.
fg 2 # Bring job 2 into foreground.
jobs # View background jobs.

^c # Good ol' ctrl-c stops the process in fg.
kill <pid> # Kill process with given process ID.

Start a command in the background.
<cmd> &

Example

Start an HTTP server on port 8080.

python -m http.server 8080 &
[1] 17999

The process is started in the background with job number 1, PID 17999.

To kill the process:

fg
^c

or...

kill 17999

Process ID (PID) and Job Number are two different things.

• PIDs apply to all users in the entire system, and are assigned by the kernel.
• Job Numbers apply to the current shell, and are numbered linearly from 1 onwards.

ps aux

ifconfig
ifconfig tun0

curl ifconfig.me
X.X.X.X

netstat -anp

Initiate a connection.
nc 192.168.1.1 8080

Listen for a connection.
nc -nlvp 4444

Download and save to a local file.
curl <url> -O
wget <url>

Download with a custom filename.
curl <url> -o filename.txt
wget <url> -O filename.txt

Download silently and display in `less`.
curl <url> -s | less
wget <url> -s | less
curl some.api.site/api/v1/users/ -s | jq | less

python -m uploadserver

curl -F files=@file1.txt -F files=@file2.txt 192.168.45.179:8000/upload

Get available disk space.
df -h
Get file size of current directory, in human readable format.
du -sh .
Get file size of txt files, in human readable format.
du -sh *.txt

Find files in operating system, and ignore errors.
find / -name '*needle*' 2>/dev/null

Find [f]iles or [d]irectories.
find . -type f -name '*needle*'
find . -type d -name '*needle*'

Find and run command on files. \; is needed for `find` to know where to terminate.
find . -type f -name '*complex*' -exec echo {} \;
find . -type f \( -name '*complex*' -or -name 'query' \) -exec du -h {} \;

Make new branch.
git checkout -b <name>

Checkout commits in tree before HEAD.
git checkout HEAD~1  # 1 commit before.
git checkout HEAD~10 # 10 commits before.

Checkout commit from parent.
git checkout HEAD^  # 1 commit before (from parent 1, base).
git checkout HEAD^2 # 1 commit before (from parent 2, target).

Store changes locally.
git stash
git stash pop

Clean edited files.
git reset [--hard]
--hard removes unstaged files.

View changes.
git diff | less
git diff <file> # See change in specific file.

Jump through commits (to find, say, the cause of a bug).
git bisect [start|reset|good|bad|skip]

Command-line git tree from git log.
git log --graph --abbrev-commit --decorate --format=format:'%C(bold blue)%h%C(reset) - %C(bold green)(%ar)%C(reset) %C(white)%s%C(reset) %C(dim white)- %an%C(reset)%C(bold yellow)%d%C(reset)' --all

More detailed git-tree 
git log --graph --abbrev-commit --decorate --format=format:'%C(bold blue)%h%C(reset) - %C(bold cyan)%aD%C(reset) %C(bold green)(%ar)%C(reset)%C(bold yellow)%d%C(reset)%n''          %C(white)%s%C(reset) %C(dim white)- %an%C(reset)' --all

Add them as git aliases in ~/.gitconfig or script aliases in ~/.bashrc.
See https://stackoverflow.com/a/9074343/10239789.

:wq  # Write to file + exit.
:q!  # Force exit.

:set number

Start a new tmux session.
tmux
Reuse a previous tmux session.
tmux attach -t 0
tmux attach -t custom-name

C-b d       # Detach session (reconnect with tmux attach -t 0)

Navigate panes
C-b (up/down/left/right)

C-b c       # New window
C-b n       # Next window
C-b p       # Previous window
C-b %       # Split pane (left/right)
C-b "       # Split pane (up/down)"
C-b x       # Close pane
C-b &       # Close window
C-b ?       # Help (common commands)

C-b (0-9)   # Jump to window #0-9
C-b z       # Zoom/Unzoom pane (useful when needing to copy something with multiple lines)
C-b ,       # Rename window

Toggle preset pane layout
C-b alt-(1-5)
C-b space   # Cycle through preset layouts

Copy mode
C-b [
C-b page-up # For scrolling
C-c         # Exit copy mode (Ctrl+c)

Search output history (make sure you're in copy mode)
/

Rename session (then use when tmux attach -t custom-name)
C-b :rename-session custom-name

echo -n '\x01\x02'

echo -n '\x41' | xxd
00000000: 41                     A

perl -e 'print "\x41"x4 . "\x42\x43"' | xxd
00000000: 4141 4141 4243         AAAABC

I've mentioned this elsewhere, but I'll repeat it here: I don't recommend using Python 3 to generate strings on-the-fly, as its string/byte-string mechanics are unintuitive. Prefer perl or echo instead.

For example: python -c 'print("\xc0")' prints \xc3\x80 (À) instead of \xc0. Why? Because the Python string "\xc0" is interpreted as U+00C0, which is \xc3\x80 in UTF-8.

assert '\xc0'.encode() == b'\xc3\x80'

Printing bytes in Python is difficult to do concisely.

strings file
strings -n <numchars> file

od -A x -S 4 file

TrebledJ

Passionate problem-solver, pentester, and autodidact. I thrive on learning new things and enjoy passing it on. When not immersed in bughunting or programming, I can be found taking walks, composing a short tune, and occasionally indulging in CTF challenges.