Step 18. Linux Basic Commands 1 — Finding Your Way in the Black Window

Level 0 — Understanding Computer Operation and Structure | Difficulty ★★★☆☆ | Estimated time: 3 hours

Prerequisites: Step 17 complete. From today on, you work inside Ubuntu in the virtual machine. Power on the VM and open a terminal.

• What you need: the Ubuntu virtual machine (installed in Step 17), a terminal. Today’s memorization goal is just five commands — pwd, ls, cd, mkdir, touch.
• Caution: today’s exercise is 100% safe because it’s inside the VM. The delete command (rm) appears, but its only targets are practice files we create ourselves. ⚠️ rm has no recycle bin, so don’t use it on anything outside what this chapter tells you to.
• Hands-on note: the outputs in this chapter are real results run on Ubuntu 24.04. The verification was done in the administrator (root) account’s home (/root), so you’ll see /root in paths, but on your VirtualBox Ubuntu you’ll see /home/username. Other than that difference, everything is the same.

Do you know why hackers in movies only ever tap away at a black window? It’s not for show. Most real servers have no graphical screen (desktop) at all. The Linux systems a security professional meets — target servers, analysis toolboxes, cloud instances — are almost always operated through the terminal (command line). Today you learn its first page: "finding your way and creating files."

---

1. Learning Objectives

By the end of this chapter, you will be able to:

• Explain that the Linux filesystem is a single tree rooted at /
• Use pwd, ls -la, and cd to figure out your location and move around without a GUI
• Create directories and files with mkdir and touch
• Know that rm has no recycle bin, and follow the check-before-deleting rule
• Use Tab completion and the ↑ key command history habitually

---

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/Environment	Ubuntu Linux terminal, default shell bash
Today’s commands	pwd (current location), ls / ls -la (listing), cd (move), mkdir / touch (create), rm / rmdir (delete)
Concepts needed	root (/), home directory (~), absolute vs. relative paths, hidden files, case sensitivity

2-1. There’s Only One Tree — /

Windows has multiple drives: C:\, D:\… each a separate tree. Linux is different. There is exactly one tree, and its root is / (a single slash, read as root).

/                  ← the root (root)
├── home           ← users' homes
│   └── lee        ← my home (home directory)
├── etc            ← configuration files
├── var            ← changing data such as logs
├── tmp            ← temporary files
└── usr            ← programs

Windows’ C:\Users\Lee is /home/lee in Linux. Plug in a USB stick or attach another disk — everything gets grafted somewhere onto this one tree like a folder. "Every storage in the world hangs on one tree" is a big difference from Windows.

2-2. Directory = Folder

In Linux, folders are called directories. They’re the same thing. From now on, this book will say "directory" when talking about Linux — understand it as "the Linux name for a folder."

2-3. "Everything Is a File" — The Philosophy of Linux

Linux’s famous design philosophy: "Everything is a file."

• A document? A file
• A directory? A special file containing a list
• A hard drive device? Represented as a file under /dev
• Information about a running process? Represented as a file under /proc

Why design it this way? To unify how you handle things. Reading, writing, copying, granting permissions — every skill you use on files works the same way on devices and system information. For now, remember just one line: when looking for something in Linux, start with "that’s probably a file too."

2-4. The Shell — What the Black Window Really Is

When you type a command into the terminal, who receives it and runs it? That intermediary is the shell. It wraps the operating system’s core (the kernel) like a shell and translates our commands — a conversation partner. Ubuntu’s default shell is bash, and the terminal window is the counter where you talk to that shell.

The relationship, in order: terminal (the counter) → shell (the interpreter) → kernel (the body). Just as PowerShell is Windows’ shell, bash is Linux’s shell. The variables, conditionals, and loops you learned in Steps 7–9 exist in bash too, and you’ll meet them again later in this course under the name shell scripts.

2-5. Case Sensitivity — A Decisive Difference from Windows

In Windows, File.txt and file.txt are treated as the same file. Linux is different — they’re treated as two completely different files. Home and home differ too.

This difference is a beginner’s first obstacle: nine out of ten "the file is clearly there but it says it isn’t" errors come down to case. This distinction also shows up in security — filename tricks that work on Windows don’t work on Linux, and differences between the two worlds lead to differences in attack and defense techniques.

---

3. Follow Along

How to open a terminal: search for Terminal under "Show Apps" at the bottom left of the Ubuntu desktop, or press Ctrl + Alt + T.

3-1. Where Am I? — pwd

Open the terminal and type:

pwd

/root

(2026-09-09, verified on Ubuntu 24.04. The verification used the root account, so it shows /root; on your VM it will show /home/username.)

How to read the output: print working directory — it tells you "where you’re standing right now." When you open a terminal, you start out standing in your own home (home directory). A regular user’s home is /home/username; the administrator root’s home is, exceptionally, /root.

Why do it: the black window has no map. pwd is the prescription when you feel lost. From now on, "where am I running this command?" will often determine the result — it’s the #1 command you’ll find yourself typing out of habit.

3-2. Looking Around — ls and ls -la

ls -la

total 28
drwx------  5 root root 4096 Sep  8 21:35 .
drwxr-xr-x 22 root root 4096 Sep  9 11:28 ..
-rw-r--r--  1 root root 3106 Apr 22  2024 .bashrc
drwx------  4 root root 4096 Sep  8 21:35 .cache
drwx------  2 root root 4096 Sep  8 21:35 .config
-rw-r--r--  1 root root    0 Sep  9 11:26 .motd_shown
-rw-r--r--  1 root root  161 Apr 22  2024 .profile
drwx------  2 root root 4096 Feb 10  2026 .ssh

(Verified 2026-09-09. On your VM you’ll also see familiar folders like Desktop and Documents.)

How to read the output:

• -l is the long format (permissions, owner, size, date); -a shows hidden files too (files starting with a dot . are hidden)
• The very first character: d means directory, - means file
• . means "right here," .. means "one level up" — you’ll use these two in the very next section
• Hidden files like .bashrc and .profile are "settings and records normally invisible to the user"

Why do it: the existence of hidden files connects directly to security. Malware and attackers love dot-prefixed files when hiding their tracks — because they’re "invisible to plain ls." From today, make ls -la your default.

3-3. Moving — The Four Steps of cd

cd /
ls

bin    dev  home  init  lib64       media  opt   root  sbin  srv  sys  usr
boot   etc  lib   lib32 lost+found  mnt    proc  run   snap  tmp  var

(Verified 2026-09-09. Some entries may differ depending on your environment.)

Just like the map in Section 2-1, you can see home, etc, var. Now let’s come back home:

cd ~
pwd

/root

The four steps, summarized:

Command	Meaning
cd Documents	Downward (relative path — relative to where you are)
cd ..	One step up (.. = parent directory)
cd ~	To my home (~ = shorthand for home directory)
cd /	To the root

Absolute vs. relative paths: writing from the root, like /home/lee/Documents, is an absolute path; writing relative to where you are, like Documents, is a relative path. It’s the same concept you learned on Windows — only the notation changed from \ to /.

3-4. Creating — mkdir and touch

Let’s make a practice space:

mkdir practice
cd practice
touch file1.txt file2.txt
ls -la

total 8
drwxr-xr-x 2 root root 4096 Sep  9 11:29 .
drwx------ 6 root root 4096 Sep  9 11:29 ..
-rw-r--r-- 1 root root    0 Sep  9 11:29 file1.txt
-rw-r--r-- 1 root root    0 Sep  9 11:29 file2.txt

(Verified 2026-09-09.)

How to read the output: mkdir creates a directory; touch creates an empty file. See the size of 0 — these are empty-shell files with no content yet.

Why touch: "staking out a spot first" turns out to be surprisingly common in real work — creating a placeholder for a log file, creating a target for a command, and of course practice like right now.

3-5. Deleting — rm and Precautions

⚠️ Caution — rm has no recycle bin. The moment you delete, it’s over; there’s no recovery menu. rm -r (delete a whole directory) in particular wipes out everything below it if you mistype the target. Today’s rule: before typing rm, always confirm with pwd and ls "where am I and what am I deleting." Thank goodness this is a VM — without this habit, you’ll someday delete something precious.

rm file1.txt
ls

file2.txt

(Verified 2026-09-09.)

It’s gone. Empty directories are removed with rmdir, which has an interesting safety mechanism. Try it on practice, which still has a file inside:

cd ~
rmdir practice

rmdir: failed to remove 'practice': Directory not empty

(Verified 2026-09-09. In a Korean-language environment you may see a Korean message like "directory is not empty.")

How to read the output: an error saying "the directory is not empty." rmdir deletes only empty directories — a safety design that prevents the accident of wiping out the contents by mistake. When you’re done practicing, delete the files inside first and then rmdir, or clean up with rm -r practice after checking.

3-6. Weapons for Your Fingers — Tab Completion and the ↑ Key

Today’s two hidden heroes.

• Tab completion: type cd pra and press Tab. It completes to practice. If there are overlapping candidates, pressing Tab twice shows them. ① It eliminates typos at the source (if it completes, the name exists), and ② it’s several times faster. Pros aren’t fast because of their typing — they’re fast because of Tab.
• ↑ key: press the up arrow and the command you just ran comes back. Keep pressing to reach the one before that, and before that. You can also see the full list with the history command. And this history is all recorded in a file (.bash_history) — convenience and record-keeping are two sides of the same coin (you’ll search this file in Step 20).

---

4. Missions & Exercises

Mission — Building a Structure Without a GUI

Using only the terminal, create the following structure:

practice-lab/
├── recon/        (recon materials)
├── logs/         (log collection)
└── notes/        (memos)
    └── day1.txt

Sequence hint: mkdir practice-lab → cd practice-lab → mkdir recon logs notes (multiple in one line!) → cd notes → touch day1.txt.

Verify: after cd ~/practice-lab, ls shows three directories, and ls notes shows day1.txt — done. When finished, demolish it too with cd ~ then rm -r practice-lab — but check with ls before deleting!

Why this matters for security: the first move when starting a breach investigation or attack exercise is "create a working directory." An evidence folder, a tools folder, a notes folder. Only the systematic stay on course amid the chaos.

Exercises

Question 1. In Linux, what do / and ~ each refer to, and what is the absolute path of the home directory of a regular user lee?

Question 2. In ls -la output, what’s the difference between entries whose first character is d and those with -, and what do the extra files shown when you add the -a option have in common?

Question 3. You created Report.txt in Linux, but cat report.txt says "no such file." State the cause and the habit that solves it.

Question 4. What does the .bash_history file contain, and why is it a staple piece of evidence in breach investigations — and a target attackers want to erase?

---

5. Model Answers & Completion Criteria

Mission Model Answer

cd ~
mkdir practice-lab
cd practice-lab
mkdir recon logs notes
cd notes
touch day1.txt
cd ~/practice-lab
ls          # logs  notes  recon
ls notes    # day1.txt

Demolition (keeping the check-before-delete habit):

cd ~
ls practice-lab      # confirm the target is correct
rm -r practice-lab

How to verify: ① Does ls show all three directories — recon, logs, notes? ② Does ls notes show day1.txt? ③ Did you check the target with ls before typing rm -r — that sequence itself is a grading criterion.

Exercise Answers

Answer 1. / is the single root of the filesystem; ~ is shorthand for "my home directory." User lee’s home is /home/lee. (For reference, administrator root’s home is exceptionally /root — that’s why this chapter’s verified outputs show /root.)

Answer 2. d is a directory; - is a regular file. Adding -a additionally shows hidden files that start with a dot (.) — such as .bashrc and .profile, settings and record files normally invisible.

Answer 3. A case mismatch — Linux treats Report.txt and report.txt as different files. Two habits solve it: ① visually confirm the real name with ls, and ② don’t type names by hand — enter them with Tab completion. If it completes, the name exists.

Answer 4. It’s a record of the commands typed in bash (the terminal). In a breach investigation, it’s evidence that plainly reveals "what commands did the attacker run on this system," which is exactly why attackers delete or tamper with this file to erase their tracks. Convenience (the ↑ key) and records (investigative clues) are two sides of the same coin.

Completion Checklist

• [ ] I can explain that Linux has a single root, /
• [ ] I can check my current location with pwd
• [ ] I can see hidden files with ls -la
• [ ] I can do the four cd moves (down/up/home/root)
• [ ] I can build a structure with mkdir and touch
• [ ] I know rm has no recycle bin, and I follow the check-before-delete rule
• [ ] I used Tab completion and the ↑ key during practice
• [ ] Mission: I built and demolished the practice-lab structure

---

6. Common Pitfalls & Fixes

Wall 1. "No such file or directory" errors

Symptom: No such file or directory.
Cause, nine times out of ten: a case mismatch. There’s documents but you need to type Documents, and so on.
Fix: check the actual name with ls and use Tab completion. When you hit this error, eyes before fingers — the habit of copying the name exactly.

Wall 2. I typed cd but nothing happened

Symptom: you typed cd and got no response.
Cause: that means success. Linux says nothing when a command succeeds — read it as "silence is success; a line of output means failure." Conversely, error messages come out as a single quiet line, so they’re easy to miss.
Fix: when in doubt, check with pwd.

Wall 3. Confusing the slash direction

Symptom: you type backslashes like home\lee.
Cause: Windows habits.
Fix: Linux always uses / (forward-leaning). Remember it as the same direction as URLs — like ubuntu.com/download.

Wall 4. I deleted a file and want it back

Symptom: you now need a file you deleted with rm.
Cause: rm has no recycle bin (Section 3-5).
Fix: it can’t be undone — that’s why the check-before-delete rule exists. However, today’s VM practice can be rolled back with a snapshot! That’s the true value of Step 17’s snapshots, and the charm of a lab where mistakes become learning instead of terror.

Wall 5. A strange symbol appears and input keeps going

Symptom: a > prompt appears and the command won’t end.
Cause: you opened a quote and never closed it. The shell is waiting, thinking "the sentence isn’t finished yet."
Fix: cancel with Ctrl + C and type it again. It’s the same kind of thing as PowerShell’s brace wall (Step 8) — if you opened it, close it.

---

7. Summary

Today’s Concepts

Concept	One-line description
/ (root)	Linux’s single root — everything starts here
Home directory	/home/username — my home, abbreviated ~
"Everything is a file"	The Linux philosophy of treating even devices and processes as files
Hidden files	Start with a dot (.) — invisible to plain ls
Case sensitivity	File and file are different files!

Today’s Commands

Command	What it does
pwd	Check current location
ls / ls -la	List / detailed listing including hidden files
cd	Move (.. up, ~ home, / root)
mkdir, touch	Create a directory, create an empty file
rm, rmdir	Delete (⚠️ no recycle bin! Always verify)
Tab, ↑	Completion, recall command history

More Important Than Commands: The Instinct

The Linux terminal is the common language of security work. Target servers, analysis tools, and CTF challenge environments are all operated through this black window. Today’s five commands — locate, list, move, create, delete — are the greetings of that common language, and the habit of viewing hidden files with ls -la and checking before rm are security habits as-is.

Remember one more thing. The place that most dramatically demonstrates Section 2-3’s "everything is a file" is /proc. Run cd /proc then ls, and you’ll see directories named with numbers — those numbers are PIDs (the ones from Step 13). Linux shows every running process as a directory, and reading the files inside reveals the process’s state. Information you viewed in Step 13 with special commands can be seen in Linux "just by reading files" — transparency created by philosophy.

---

Once every box is checked, Step 18 is complete. Click the checkbox in the sidebar to save your progress.