Blog

Kali Linux ships with over 600 pre‑installed tools, but knowing the fundamental commands to navigate and control the operating system is what separates a confident user from a lost one. Below is a categorized reference of the most frequently used commands – from system information to network diagnostics and authorized security checks. Each entry is followed by a brief explanation so you can apply them immediately in your own labs and practice environments.

System Information and Status

Before running any diagnostic or analysis tool, you need a clear picture of the hardware and software you are working with. These commands give you that baseline.

For more detailed hardware probing, the lspci and lsusb commands list connected PCI and USB devices respectively. Adding -v increases verbosity.

File Operations and Permissions

Efficient file handling is core to any Linux workflow. Beyond basic ls, cp, and mv, pay attention to permission management – especially when setting up secure environments.

• find /path -name "*.conf" – Locate configuration files recursively.
• grep -r "pattern" /etc/ – Search inside files for a string without opening them.
• chmod 640 file – Set read/write for owner, read for group, no access for others.
• chown user:group file – Change file owner and group.
• stat file – Show detailed metadata including access time, modify time, and permissions.
• rsync -avz source destination – Synchronise files locally or over SSH with compression.
• tar -czvf archive.tar.gz /path – Create a compressed tarball for backups.

If you are new to Linux permissions, the Free Online Resources to Learn Linux as a Beginner can help you practise these concepts in a low‑risk environment before moving to a full pentesting distribution.

Network Diagnostics

Network troubleshooting is a daily task for both developers and security practitioners. The tools below are safe to run on systems you own or have written permission to test.

Always ensure you have explicit permission before scanning any network that you do not own. Tools like nmap can be intrusive – restrict scans to your own lab environment (such as a VirtualBox virtual network).

Process Management

Knowing what is running on your system helps you detect suspicious behaviour and also control resource hogs.

• ps aux – List all processes with user, CPU, memory, and command.
• top / htop – Interactive process viewer (install htop for a friendlier interface).
• kill -15 PID – Gracefully terminate a process (SIGTERM).
• kill -9 PID – Force‑kill a process (SIGKILL) – use sparingly.
• pgrep firefox – Find process IDs by name.
• nice -n 10 command – Start a command with lower priority.
• systemctl status service – Check the status of a systemd service (e.g. systemctl status sshd).
• journalctl -u service --since today – View logs for a specific unit from today.

Package Management (APT)

Kali is built on Debian, so apt is your primary package manager. Regular updates ensure you have the latest security patches and tool versions.

sudo apt update          # refresh package index
sudo apt upgrade         # upgrade all installed packages
sudo apt install nmap    # install a specific tool
sudo apt remove nmap     # remove a tool (preserves config files)
sudo apt purge nmap      # remove tool and config files
apt search wireless      # search for packages containing 'wireless'

Always run apt upgrade before starting a new lab session to avoid working with outdated tools.

Security Tools for Authorised Testing

Kali’s reputation comes from its security toolset. Below are commands you can use in your own virtual lab or on a system you own for learning defensive techniques.

These tools are powerful but can be misused. Always operate within the boundaries of your authorised testing environment. The moment you run a scan against an IP you do not own, you break the law in most jurisdictions.

Working with Logs and Audit Trails

Understanding system logs is critical for both debugging and security monitoring.

• dmesg | tail -20 – Show the last 20 kernel ring buffer messages (hardware events).
• tail -f /var/log/syslog – Follow new log entries in real time.
• grep "FAILED" /var/log/auth.log – Find authentication failures – useful for spotting brute‑force attempts.
• last -10 – Show the last 10 logins.
• auditctl -w /etc/passwd -p wa -k passwd_changes – Monitor file access via the Linux Audit subsystem; view logs with ausearch -k passwd_changes.

Keeping an eye on auth logs after you deploy a web server can reveal scan bots and early attack attempts.

Automation and Scripting Basics

Once you are comfortable with individual commands, combine them into Bash scripts to save time.

• #!/bin/bash – Shebang at the top of every script.
• for ip in $(seq 1 254); do ping -c 1 192.168.1.$ip & done – Parallel ping sweep (remember to add a short delay to avoid flooding).
• while read line; do echo "Processing $line"; done < input.txt – Read a file line by line.
• crontab -e – Schedule scripts to run at specific intervals (great for routine log analysis).

Final Note on Responsibility

The commands listed here are your entry point to mastering Kali Linux. Practise them inside a virtual machine with a snapshot – if something breaks, revert. As you grow more confident, you will naturally layer on more advanced tools like Metasploit in its authorised testing mode, or Burp Suite for web application assessments. Always keep a log of what you run and why; it builds good habits for real-world security work. Next time you need to inspect a service’s log output, try journalctl -u sshd --since "1 hour ago" --no-pager – it is far more efficient than scrolling through massive text files.