Linux Basics
A complete beginner foundation: navigation, files, text, search, permissions, processes, streams, and identity.
Navigation Essentials
Learn where you are, what is around you, and how to move through Linux directories using absolute and relative paths.
Files & Directories
Create, copy, rename, move, and remove files so later security tasks feel natural instead of memorized.
Reading Text Files
Inspect small and large text files using cat, head, tail, and less—the everyday toolkit for configuration and log review.
Search & Filtering
Find useful lines and files with grep and find, including line numbers, case-insensitive matches, and wildcard names.
Linux Permissions
Understand rwx bits, symbolic chmod, and numeric modes before moving on to security hardening.
Processes & PIDs
Read the process table, understand PIDs, and use a pipeline to isolate a process without taking destructive action.
Pipes & Redirection
Connect commands and persist terminal output using pipes, overwrite redirection, append redirection, and tee.
Users & System Context
Identify the current user, group memberships, hostname, operating system, and command history before entering the defender path.
Linux for Cybersecurity
Apply Linux fluency to hardening, log analysis, SUID review, process response, network triage, and persistence hunting.
Permissions & Hardening
Apply your permission knowledge to identify and fix a world-readable application secret.
Log Investigation
Use grep and log-reading skills to isolate suspicious SSH authentication activity and an attacker source address.
SUID Hunting
Search for SUID files, inspect a risky custom helper, and remove an unnecessary privilege-escalation exposure.
Process Response
Triage abnormal CPU usage, correlate a suspicious PID, and contain a simulated cryptominer process.
Network Triage
Inspect interfaces and listening sockets, then correlate an unexpected exposed port with a process.
Persistence Hunting
Inspect cron-based persistence, trace a hidden /tmp payload, and quarantine the scheduled task while preserving evidence.
Incident Response
Correlate evidence and contain a simulated Linux compromise in a capstone room.