Step 18. Linux Basic Commands 1 — Finding Your Way in the Black Window
Level 0 — Understanding Computer Operation and Structure | Difficulty ★★★☆☆ | Estimated time: 3 hours
Prerequisites: Step 17 complete. From today on, you work inside Ubuntu in the virtual machine. Power on the VM and open a terminal.
- What you need: the Ubuntu virtual machine (installed in Step 17), a terminal. Today’s memorization goal is just five commands —
pwd,ls,cd,mkdir,touch. - Caution: today’s exercise is 100% safe because it’s inside the VM. The delete command (
rm) appears, but its only targets are practice files we create ourselves. ⚠️rmhas no recycle bin, so don’t use it on anything outside what this chapter tells you to. - Hands-on note: the outputs in this chapter are real results run on Ubuntu 24.04. The verification was done in the administrator (root) account’s home (
/root), so you’ll see/rootin paths, but on your VirtualBox Ubuntu you’ll see/home/username. Other than that difference, everything is the same.
Do you know why hackers in movies only ever tap away at a black window? It’s not for show. Most real servers have no graphical screen (desktop) at all. The Linux systems a security professional meets — target servers, analysis toolboxes, cloud instances — are almost always operated through the terminal (command line). Today you learn its first page: "finding your way and creating files."
1. Learning Objectives
By the end of this chapter, you will be able to:
- Explain that the Linux filesystem is a single tree rooted at
/ - Use
pwd,ls -la, andcdto figure out your location and move around without a GUI - Create directories and files with
mkdirandtouch - Know that
rmhas no recycle bin, and follow the check-before-deleting rule - Use Tab completion and the ↑ key command history habitually
2. Background Knowledge — Today’s Tools and Concepts
Today’s Tools at a Glance
| Category | Details |
|---|---|
| Language/Environment | Ubuntu Linux terminal, default shell bash |
| Today’s commands | pwd (current location), ls / ls -la (listing), cd (move), mkdir / touch (create), rm / rmdir (delete) |
| Concepts needed | root (/), home directory (~), absolute vs. relative paths, hidden files, case sensitivity |
2-1. There’s Only One Tree — /
Windows has multiple drives: C:\, D:\… each a separate tree. Linux is different. There is exactly one tree, and its root is / (a single slash, read as root).
/ ← the root (root)
├── home ← users' homes
│ └── lee ← my home (home directory)
├── etc ← configuration files
├── var ← changing data such as logs
├── tmp ← temporary files
└── usr ← programs
Windows’ C:\Users\Lee is /home/lee in Linux. Plug in a USB stick or attach another disk — everything gets grafted somewhere onto this one tree like a folder. "Every storage in the world hangs on one tree" is a big difference from Windows.
2-2. Directory = Folder
In Linux, folders are called directories. They’re the same thing. From now on, this book will say "directory" when talking about Linux — understand it as "the Linux name for a folder."
2-3. "Everything Is a File" — The Philosophy of Linux
Linux’s famous design philosophy: "Everything is a file."
- A document? A file
- A directory? A special file containing a list
- A hard drive device? Represented as a file under
/dev - Information about a running process? Represented as a file under
/proc
Why design it this way? To unify how you handle things. Reading, writing, copying, granting permissions — every skill you use on files works the same way on devices and system information. For now, remember just one line: when looking for something in Linux, start with "that’s probably a file too."
2-4. The Shell — What the Black Window Really Is
When you type a command into the terminal, who receives it and runs it? That intermediary is the shell. It wraps the operating system’s core (the kernel) like a shell and translates our commands — a conversation partner. Ubuntu’s default shell is bash, and the terminal window is the counter where you talk to that shell.
The relationship, in order: terminal (the counter) → shell (the interpreter) → kernel (the body). Just as PowerShell is Windows’ shell, bash is Linux’s shell. The variables, conditionals, and loops you learned in Steps 7–9 exist in bash too, and you’ll meet them again later in this course under the name shell scripts.
2-5. Case Sensitivity — A Decisive Difference from Windows
In Windows, File.txt and file.txt are treated as the same file. Linux is different — they’re treated as two completely different files. Home and home differ too.
This difference is a beginner’s first obstacle: nine out of ten "the file is clearly there but it says it isn’t" errors come down to case. This distinction also shows up in security — filename tricks that work on Windows don’t work on Linux, and differences between the two worlds lead to differences in attack and defense techniques.
3. Follow Along
How to open a terminal: search for Terminal under "Show Apps" at the bottom left of the Ubuntu desktop, or press Ctrl + Alt + T.
3-1. Where Am I? — pwd
Open the terminal and type:
pwd
/root
(2026-09-09, verified on Ubuntu 24.04. The verification used the root account, so it shows /root; on your VM it will show /home/username.)
How to read the output: print working directory — it tells you "where you’re standing right now." When you open a terminal, you start out standing in your own home (home directory). A regular user’s home is /home/username; the administrator root’s home is, exceptionally, /root.
Why do it: the black window has no map. pwd is the prescription when you feel lost. From now on, "where am I running this command?" will often determine the result — it’s the #1 command you’ll find yourself typing out of habit.
3-2. Looking Around — ls and ls -la
ls -la
total 28
drwx------ 5 root root 4096 Sep 8 21:35 .
drwxr-xr-x 22 root root 4096 Sep 9 11:28 ..
-rw-r--r-- 1 root root 3106 Apr 22 2024 .bashrc
drwx------ 4 root root 4096 Sep 8 21:35 .cache
drwx------ 2 root root 4096 Sep 8 21:35 .config
-rw-r--r-- 1 root root 0 Sep 9 11:26 .motd_shown
-rw-r--r-- 1 root root 161 Apr 22 2024 .profile
drwx------ 2 root root 4096 Feb 10 2026 .ssh
(Verified 2026-09-09. On your VM you’ll also see familiar folders like Desktop and Documents.)
How to read the output:
-lis the long format (permissions, owner, size, date);-ashows hidden files too (files starting with a dot.are hidden)- The very first character:
dmeans directory,-means file .means "right here,"..means "one level up" — you’ll use these two in the very next section- Hidden files like
.bashrcand.profileare "settings and records normally invisible to the user"
Why do it: the existence of hidden files connects directly to security. Malware and attackers love dot-prefixed files when hiding their tracks — because they’re "invisible to plain ls." From today, make ls -la your default.
3-3. Moving — The Four Steps of cd
cd /
ls
bin dev home init lib64 media opt root sbin srv sys usr
boot etc lib lib32 lost+found mnt proc run snap tmp var
(Verified 2026-09-09. Some entries may differ depending on your environment.)
Just like the map in Section 2-1, you can see home, etc, var. Now let’s come back home:
cd ~
pwd
/root
The four steps, summarized:
| Command | Meaning |
|---|---|
cd Documents |
Downward (relative path — relative to where you are) |
cd .. |
One step up (.. = parent directory) |
cd ~ |
To my home (~ = shorthand for home directory) |
cd / |
To the root |
Absolute vs. relative paths: writing from the root, like /home/lee/Documents, is an absolute path; writing relative to where you are, like Documents, is a relative path. It’s the same concept you learned on Windows — only the notation changed from \ to /.
3-4. Creating — mkdir and touch
Let’s make a practice space:
mkdir practice
cd practice
touch file1.txt file2.txt
ls -la
total 8
drwxr-xr-x 2 root root 4096 Sep 9 11:29 .
drwx------ 6 root root 4096 Sep 9 11:29 ..
-rw-r--r-- 1 root root 0 Sep 9 11:29 file1.txt
-rw-r--r-- 1 root root 0 Sep 9 11:29 file2.txt
(Verified 2026-09-09.)
How to read the output: mkdir creates a directory; touch creates an empty file. See the size of 0 — these are empty-shell files with no content yet.
Why touch: "staking out a spot first" turns out to be surprisingly common in real work — creating a placeholder for a log file, creating a target for a command, and of course practice like right now.
3-5. Deleting — rm and Precautions
⚠️ Caution —
rmhas no recycle bin. The moment you delete, it’s over; there’s no recovery menu.rm -r(delete a whole directory) in particular wipes out everything below it if you mistype the target. Today’s rule: before typing rm, always confirm with pwd and ls "where am I and what am I deleting." Thank goodness this is a VM — without this habit, you’ll someday delete something precious.
rm file1.txt
ls
file2.txt
(Verified 2026-09-09.)
It’s gone. Empty directories are removed with rmdir, which has an interesting safety mechanism. Try it on practice, which still has a file inside:
cd ~
rmdir practice
rmdir: failed to remove 'practice': Directory not empty
(Verified 2026-09-09. In a Korean-language environment you may see a Korean message like "directory is not empty.")
How to read the output: an error saying "the directory is not empty." rmdir deletes only empty directories — a safety design that prevents the accident of wiping out the contents by mistake. When you’re done practicing, delete the files inside first and then rmdir, or clean up with rm -r practice after checking.
3-6. Weapons for Your Fingers — Tab Completion and the ↑ Key
Today’s two hidden heroes.
- Tab completion: type
cd praand press Tab. It completes topractice. If there are overlapping candidates, pressing Tab twice shows them. ① It eliminates typos at the source (if it completes, the name exists), and ② it’s several times faster. Pros aren’t fast because of their typing — they’re fast because of Tab. - ↑ key: press the up arrow and the command you just ran comes back. Keep pressing to reach the one before that, and before that. You can also see the full list with the
historycommand. And this history is all recorded in a file (.bash_history) — convenience and record-keeping are two sides of the same coin (you’ll search this file in Step 20).
4. Missions & Exercises
Mission — Building a Structure Without a GUI
Using only the terminal, create the following structure:
practice-lab/
├── recon/ (recon materials)
├── logs/ (log collection)
└── notes/ (memos)
└── day1.txt
Sequence hint: mkdir practice-lab → cd practice-lab → mkdir recon logs notes (multiple in one line!) → cd notes → touch day1.txt.
Verify: after cd ~/practice-lab, ls shows three directories, and ls notes shows day1.txt — done. When finished, demolish it too with cd ~ then rm -r practice-lab — but check with ls before deleting!
Why this matters for security: the first move when starting a breach investigation or attack exercise is "create a working directory." An evidence folder, a tools folder, a notes folder. Only the systematic stay on course amid the chaos.
Exercises
Question 1. In Linux, what do / and ~ each refer to, and what is the absolute path of the home directory of a regular user lee?
Question 2. In ls -la output, what’s the difference between entries whose first character is d and those with -, and what do the extra files shown when you add the -a option have in common?
Question 3. You created Report.txt in Linux, but cat report.txt says "no such file." State the cause and the habit that solves it.
Question 4. What does the .bash_history file contain, and why is it a staple piece of evidence in breach investigations — and a target attackers want to erase?
5. Model Answers & Completion Criteria
Mission Model Answer
cd ~
mkdir practice-lab
cd practice-lab
mkdir recon logs notes
cd notes
touch day1.txt
cd ~/practice-lab
ls # logs notes recon
ls notes # day1.txt
Demolition (keeping the check-before-delete habit):
cd ~
ls practice-lab # confirm the target is correct
rm -r practice-lab
How to verify: ① Does ls show all three directories — recon, logs, notes? ② Does ls notes show day1.txt? ③ Did you check the target with ls before typing rm -r — that sequence itself is a grading criterion.
Exercise Answers
Answer 1. / is the single root of the filesystem; ~ is shorthand for "my home directory." User lee’s home is /home/lee. (For reference, administrator root’s home is exceptionally /root — that’s why this chapter’s verified outputs show /root.)
Answer 2. d is a directory; - is a regular file. Adding -a additionally shows hidden files that start with a dot (.) — such as .bashrc and .profile, settings and record files normally invisible.
Answer 3. A case mismatch — Linux treats Report.txt and report.txt as different files. Two habits solve it: ① visually confirm the real name with ls, and ② don’t type names by hand — enter them with Tab completion. If it completes, the name exists.
Answer 4. It’s a record of the commands typed in bash (the terminal). In a breach investigation, it’s evidence that plainly reveals "what commands did the attacker run on this system," which is exactly why attackers delete or tamper with this file to erase their tracks. Convenience (the ↑ key) and records (investigative clues) are two sides of the same coin.
Completion Checklist
- [ ] I can explain that Linux has a single root,
/ - [ ] I can check my current location with
pwd - [ ] I can see hidden files with
ls -la - [ ] I can do the four
cdmoves (down/up/home/root) - [ ] I can build a structure with
mkdirandtouch - [ ] I know
rmhas no recycle bin, and I follow the check-before-delete rule - [ ] I used Tab completion and the ↑ key during practice
- [ ] Mission: I built and demolished the practice-lab structure
6. Common Pitfalls & Fixes
Wall 1. "No such file or directory" errors
Symptom: No such file or directory.
Cause, nine times out of ten: a case mismatch. There’s documents but you need to type Documents, and so on.
Fix: check the actual name with ls and use Tab completion. When you hit this error, eyes before fingers — the habit of copying the name exactly.
Wall 2. I typed cd but nothing happened
Symptom: you typed cd and got no response.
Cause: that means success. Linux says nothing when a command succeeds — read it as "silence is success; a line of output means failure." Conversely, error messages come out as a single quiet line, so they’re easy to miss.
Fix: when in doubt, check with pwd.
Wall 3. Confusing the slash direction
Symptom: you type backslashes like home\lee.
Cause: Windows habits.
Fix: Linux always uses / (forward-leaning). Remember it as the same direction as URLs — like ubuntu.com/download.
Wall 4. I deleted a file and want it back
Symptom: you now need a file you deleted with rm.
Cause: rm has no recycle bin (Section 3-5).
Fix: it can’t be undone — that’s why the check-before-delete rule exists. However, today’s VM practice can be rolled back with a snapshot! That’s the true value of Step 17’s snapshots, and the charm of a lab where mistakes become learning instead of terror.
Wall 5. A strange symbol appears and input keeps going
Symptom: a > prompt appears and the command won’t end.
Cause: you opened a quote and never closed it. The shell is waiting, thinking "the sentence isn’t finished yet."
Fix: cancel with Ctrl + C and type it again. It’s the same kind of thing as PowerShell’s brace wall (Step 8) — if you opened it, close it.
7. Summary
Today’s Concepts
| Concept | One-line description |
|---|---|
/ (root) |
Linux’s single root — everything starts here |
| Home directory | /home/username — my home, abbreviated ~ |
| "Everything is a file" | The Linux philosophy of treating even devices and processes as files |
| Hidden files | Start with a dot (.) — invisible to plain ls |
| Case sensitivity | File and file are different files! |
Today’s Commands
| Command | What it does |
|---|---|
pwd |
Check current location |
ls / ls -la |
List / detailed listing including hidden files |
cd |
Move (.. up, ~ home, / root) |
mkdir, touch |
Create a directory, create an empty file |
rm, rmdir |
Delete (⚠️ no recycle bin! Always verify) |
Tab, ↑ |
Completion, recall command history |
More Important Than Commands: The Instinct
The Linux terminal is the common language of security work. Target servers, analysis tools, and CTF challenge environments are all operated through this black window. Today’s five commands — locate, list, move, create, delete — are the greetings of that common language, and the habit of viewing hidden files with ls -la and checking before rm are security habits as-is.
Remember one more thing. The place that most dramatically demonstrates Section 2-3’s "everything is a file" is /proc. Run cd /proc then ls, and you’ll see directories named with numbers — those numbers are PIDs (the ones from Step 13). Linux shows every running process as a directory, and reading the files inside reveals the process’s state. Information you viewed in Step 13 with special commands can be seen in Linux "just by reading files" — transparency created by philosophy.
Once every box is checked, Step 18 is complete. Click the checkbox in the sidebar to save your progress.