Step 18. Linux Basic Commands 1 — Finding Your Way in the Black Window

Level 0 — Understanding Computer Operation and Structure | Difficulty ★★★☆☆ | Estimated time: 3 hours

Prerequisites: Step 17 complete. From today on, you work inside Ubuntu in the virtual machine. Power on the VM and open a terminal.

• What you need: the Ubuntu virtual machine (installed in Step 17), a terminal. This section’s memorization goal is just five commands — pwd, ls, cd, mkdir, touch.
• Caution: this section’s exercise is read-only in the stated lab because it’s inside the VM. The delete command (rm) appears, but its only targets are practice files we create ourselves. ⚠️ rm has no recycle bin, so don’t use it on anything outside what this unit tells you to.
• Hands-on note: the outputs in this unit are real results run on Ubuntu 24.04. The verification was done in the administrator (root) account’s home (/root), so you’ll see /root in paths, but on your VirtualBox Ubuntu you’ll see /home/username. Other than that difference, everything is the same.

Do you know why hackers in movies only ever tap away at a black window? It’s not for show. Most real servers have no graphical screen (desktop) at all. The Linux systems a security professional meets — target servers, analysis toolboxes, cloud instances — are almost always operated through the terminal (command line). Today you learn its first page: “finding your way and creating files.”

1. Learning Objectives

By the end of this unit, you will be able to:

• Explain that the Linux filesystem is a single tree rooted at /
• Use pwd, ls -la, and cd to figure out your location and move around without a GUI
• Create directories and files with mkdir and touch
• Know that rm has no recycle bin, and follow the check-before-deleting rule
• Use Tab completion and the ↑ key command history habitually

2. Background Knowledge — Today’s Tools and Concepts

This section’s Tools at a Glance

2-1. There’s Only One Tree — /

Windows has multiple drives: C:, D:… each a separate tree. Linux is different. There is exactly one tree, and its root is / (a single slash, read as root).

/                  ← the root (root)
├── home           ← users' homes
│   └── lee        ← my home (home directory)
├── etc            ← configuration files
├── var            ← changing data such as logs
├── tmp            ← temporary files
└── usr            ← programs

Windows’ C:\Users\Lee is /home/lee in Linux. Plug in a USB stick or attach another disk — everything gets grafted somewhere onto this one tree like a folder. “Every storage in the world hangs on one tree” is a big difference from Windows.

2-2. Directory = Folder

In Linux, folders are called directories. They’re the same thing. From now on, this book will say “directory” when talking about Linux — understand it as “the Linux name for a folder.”

2-3. “Everything Is a File” — The Philosophy of Linux

Linux’s famous design philosophy: “Everything is a file.”

• A document? A file
• A directory? A special file containing a list
• A hard drive device? Represented as a file under /dev
• Information about a running process? Represented as a file under /proc

Why design it this way? To unify how you handle things. Reading, writing, copying, granting permissions — every skill you use on files works the same way on devices and system information. For now, remember just one line: when looking for something in Linux, start with “that’s probably a file too.”

2-4. The Shell — What the Black Window Really Is

When you type a command into the terminal, who receives it and runs it? That intermediary is the shell. It wraps the operating system’s core (the kernel) like a shell and translates our commands — a conversation partner. Ubuntu’s default shell is bash, and the terminal window is the counter where you talk to that shell.

The relationship, in order: terminal (the counter) → shell (the interpreter) → kernel (the body). Just as PowerShell is Windows’ shell, bash is Linux’s shell. The variables, conditionals, and loops you learned in Steps 7–9 exist in bash too, and you’ll meet them again later in this course under the name shell scripts.

2-5. Case Sensitivity — A Decisive Difference from Windows

In Windows, File.txt and file.txt are treated as the same file. Linux is different — they’re treated as two completely different files. Home and home differ too.

Case mismatch is one common cause of a path error. Also check the current directory, spelling, permissions, and whether the file exists. Filesystem and mount options can affect case behavior.

3. Follow Along

Before you begin. Use a regular user, not a root shell. Confirm pwd before removing your practice directory. If you are using WSL, paths under /mnt/c are Windows files, not disposable guest data.

How to open a terminal: search for Terminal under “Show Apps” at the bottom left of the Ubuntu desktop, or press Ctrl + Alt + T.

3-1. Where Am I? — pwd

Open the terminal and type:

pwd

/root

(2026-09-09, source example using Ubuntu 24.04. The source example used the root account, so it shows /root; on your VM it will show /home/username.)

How to read the output: print working directory — it tells you “where you’re standing right now.” When you open a terminal, you start out standing in your own home (home directory). A regular user’s home is /home/username; the administrator root’s home is, exceptionally, /root.

Why do it: the black window has no map. pwd is the prescription when you feel lost. From now on, “where am I running this command?” will often determine the result — it’s the #1 command you’ll find yourself typing out of habit.

3-2. Looking Around — ls and ls -la

ls -la

total 28
drwx------  5 root root 4096 Sep  8 21:35 .
drwxr-xr-x 22 root root 4096 Sep  9 11:28 ..
-rw-r--r--  1 root root 3106 Apr 22  2024 .bashrc
drwx------  4 root root 4096 Sep  8 21:35 .cache
drwx------  2 root root 4096 Sep  8 21:35 .config
-rw-r--r--  1 root root    0 Sep  9 11:26 .motd_shown
-rw-r--r--  1 root root  161 Apr 22  2024 .profile
drwx------  2 root root 4096 Feb 10  2026 .ssh

Illustrative output. Values, wording, account names, and available fields vary by environment.

How to read the output:

• -l is the long format (permissions, owner, size, date); -a shows hidden files too (files starting with a dot . are hidden)
• The very first character: d means directory, - means file
• . means “right here,” .. means “one level up” — you’ll use these two in the very next section
• Hidden files like .bashrc and .profile are “settings and records normally invisible to the user”

Why do it: the existence of hidden files connects directly to security. Malware and attackers love dot-prefixed files when hiding their tracks — because they’re “invisible to plain ls.” From today, make ls -la your default.

3-3. Moving — The Four Steps of cd

cd /
ls

bin    dev  home  init  lib64       media  opt   root  sbin  srv  sys  usr
boot   etc  lib   lib32 lost+found  mnt    proc  run   snap  tmp  var

Illustrative output. Values, wording, account names, and available fields vary by environment.

Just like the map in Section 2-1, you can see home, etc, var. Now let’s come back home:

cd ~
pwd

/root

The four steps, summarized:

Absolute vs. relative paths: writing from the root, like /home/lee/Documents, is an absolute path; writing relative to where you are, like Documents, is a relative path. It’s the same concept you learned on Windows — only the notation changed from \ to /.

3-4. Creating — mkdir and touch

Let’s make a practice space:

mkdir practice
cd practice
touch file1.txt file2.txt
ls -la

total 8
drwxr-xr-x 2 root root 4096 Sep  9 11:29 .
drwx------ 6 root root 4096 Sep  9 11:29 ..
-rw-r--r-- 1 root root    0 Sep  9 11:29 file1.txt
-rw-r--r-- 1 root root    0 Sep  9 11:29 file2.txt

Illustrative output. Values, wording, account names, and available fields vary by environment.

How to read the output: mkdir creates a directory; touch creates an empty file. See the size of 0 — these are empty-shell files with no content yet.

Why touch: “staking out a spot first” turns out to be surprisingly common in real work — creating a placeholder for a log file, creating a target for a command, and of course practice like right now.

3-5. Deleting — rm and Precautions

⚠️ Caution — rm has no recycle bin. The moment you delete, it’s over; there’s no recovery menu. rm -r (delete a whole directory) in particular wipes out everything below it if you mistype the target. This section’s rule: before typing rm, always confirm with pwd and ls “where am I and what am I deleting.” Thank goodness this is a VM — without this habit, you’ll someday delete something precious.

rm file1.txt
ls

file2.txt

Illustrative output. Values, wording, account names, and available fields vary by environment.

It’s gone. Empty directories are removed with rmdir, which has an interesting safety mechanism. Try it on practice, which still has a file inside:

cd ~
rmdir practice

rmdir: failed to remove 'practice': Directory not empty

Illustrative output. Values, wording, account names, and available fields vary by environment.

How to read the output: an error saying “the directory is not empty.” rmdir deletes only empty directories — a safety design that prevents the accident of wiping out the contents by mistake. When you’re done practicing, delete the files inside first and then rmdir, or clean up with rm -r practice after checking.

3-6. Weapons for Your Fingers — Tab Completion and the ↑ Key

This section’s two hidden heroes.

• Tab completion: type cd pra and press Tab. It completes to practice. If there are overlapping candidates, pressing Tab twice shows them. ① It eliminates typos at the source (if it completes, the name exists), and ② it’s several times faster. Pros aren’t fast because of their typing — they’re fast because of Tab.
• ↑ key: press the up arrow and the command you just ran comes back. Keep pressing to reach the one before that, and before that. You can also see the full list with the history command. And this history is all recorded in a file (.bash_history) — convenience and record-keeping are two sides of the same coin (you’ll search this file in Step 20).

4. Missions & Exercises

Mission — Building a Structure Without a GUI

Using only the terminal, create the following structure:

practice-lab/
├── recon/        (recon materials)
├── logs/         (log collection)
└── notes/        (memos)
    └── day1.txt

Sequence hint: mkdir practice-lab → cd practice-lab → mkdir recon logs notes (multiple in one line!) → cd notes → touch day1.txt.

Verify: after cd ~/practice-lab, ls shows three directories, and ls notes shows day1.txt — done. When finished, demolish it too with cd ~ then rm -r practice-lab — but check with ls before deleting!

Why this matters for security: the first move when starting a breach investigation or attack exercise is “create a working directory.” An evidence folder, a tools folder, a notes folder. Only the systematic stay on course amid the chaos.

Exercises

Question 1. In Linux, what do / and ~ each refer to, and what is the absolute path of the home directory of a regular user lee?

Question 2. In ls -la output, what’s the difference between entries whose first character is d and those with -, and what do the extra files shown when you add the -a option have in common?

Question 3. You created Report.txt in Linux, but cat report.txt says “no such file.” State the cause and the habit that solves it.

Question 4. What does the .bash_history file contain, and why is it a staple piece of evidence in breach investigations — and a target attackers want to erase?

cd ~
mkdir practice-lab
cd practice-lab
mkdir recon logs notes
cd notes
touch day1.txt
cd ~/practice-lab
ls          # logs  notes  recon
ls notes    # day1.txt

cd ~
ls practice-lab      # confirm the target is correct
rm -r practice-lab

6. Common Pitfalls & Fixes

Wall 1. “No such file or directory” errors

Cause: possible case mismatch, incorrect directory, missing file, or another path error. Compare the actual names with ls.

Wall 2. I typed cd but nothing happened

Cause: a successful cd is normally silent, but silence alone is not proof. Check its immediate exit status and confirm the new location with pwd.

Wall 3. Confusing the slash direction

Symptom: you type backslashes like home\lee.
Cause: Windows habits.
Fix: Linux always uses / (forward-leaning). Remember it as the same direction as URLs — like ubuntu.com/download.

Wall 4. I deleted a file and want it back

Symptom: you now need a file you deleted with rm.
Cause: rm has no recycle bin (Section 3-5).
Fix: it can’t be undone — that’s why the check-before-delete rule exists. However, this section’s VM practice can be rolled back with a snapshot! That’s the true value of Step 17’s snapshots, and the charm of a lab where mistakes become learning instead of terror.

Wall 5. A strange symbol appears and input keeps going

Symptom: a > prompt appears and the command won’t end.
Cause: you opened a quote and never closed it. The shell is waiting, thinking “the sentence isn’t finished yet.”
Fix: cancel with Ctrl + C and type it again. It’s the same kind of thing as PowerShell’s brace wall (Step 8) — if you opened it, close it.

7. Summary

This section’s Concepts

This section’s Commands

More Important Than Commands: The Instinct

The Linux terminal is the common language of security work. Target servers, analysis tools, and CTF challenge environments are all operated through this black window. This section’s five commands — locate, list, move, create, delete — are the greetings of that common language, and the habit of viewing hidden files with ls -la and checking before rm are security habits as-is.

Remember one more thing. The place that most dramatically demonstrates Section 2-3’s “everything is a file” is /proc. Run cd /proc then ls, and you’ll see directories named with numbers — those numbers are PIDs (the ones from Step 13). Linux shows every running process as a directory, and reading the files inside reveals the process’s state. Information you viewed in Step 13 with special commands can be seen in Linux “just by reading files” — transparency created by philosophy.

Once every box is checked, Step 18 is complete.