Linux

The default display manager in RHEL 9 is called GDM(GNOME Display Manager) Linux Directory Structure: Linux files are organized logically in a hierarchy for ease of administration and recognition. This organization is maintained in hundreds of directories located in larger containers called file systems. Red Hat Enterprise Linux follows the Filesystem Hierarchy Standard (FHS) for file organization, which describes names, locations, and permissions for many file types and directories. The Linux directory structure is analogous to an inverted tree, where the top of the tree is the root of the directory, tree branches are subdirectories, and leaves are files. Path example: /etc/rc.d/init.d/README The etc directory is located under / -> here / is the parent and etc is the child. rc.d(child) is located under etc(parent) . init.d(child) is located under rc.d(parent) . README(leaf) is located under init.d(parent) . ==SUB-DIRECTORY:== A directory that has a parent directory. Note The root directory has no parent, and the lowest level subdirectory has no child. ...

Note In 1984 Richard Stallman, an American software engineer, had a goal to create a completely free UNIX-compatible open-source (non-proprietary) operating system. The initiative was called the GNU Project (GNU’s Not Unix) and by 1991. Then Linus Torvalds developed a kernel and proclaimed it’s availability. ...

Penetration Testing basics: Pre-engagement: NDA: An NDA is a legal agreement that specifies that a penetration tester and their employer will not share or hold onto any sensitive or proprietary information that is encountered during the assessment. RoE: The scope of a penetration test, also known as the rules of engagement, defines the systems the penetration tester can and cannot hack. This ensures the penetration tester remains within legal boundaries. ...

One of the most rudimentary command in linux is ls. Some options of ls: Options Description -a Shows hidden files and directories. A file or directory name that begins with the period character. -l Displays long listing with detailed file information like file type, permissions, link count, owner etc. -ld Displays long listing of the specified directory but hides its contents. -lh Displays long listing with file sizes shown in human-friendly format. -lt Lists all files sorted by date and time with the newest file first. -ltr Lists all files sorted by date and time with the oldest file first (reverse). -R Lists contents of the specified directory and all its subdirectories (recursive listing). ls -l: Long listing of the files. ls -al: List all the hidden files in the current working directory. Debriefing the columns: Columns 1: The first character (hyphen or d) divulges the file type, and the next nine characters (rw-rw-r–) indicate permissions. Column 2: Displays the number of link. Column 3: Shows the owner name. Column 4: Exhibits the owning group name. Column 5: Identifies the file size in bytes. For directories, this number reflects the number of blocks being used by the directory to hold information about its contents. Column 6,7,8: Displays the month, day, and time of creation or last modification. Column 9: Indicates the name of the file or directory. ls -ll: Alternative of ls -l , does the same thing. ls -ld {directory_name}: Shows long listing of the specified directory. For example: ls -ld /usr ls -alh: To show all the files in the current directory with their sizes in human readable format. ls -lt: Shows the output in a sorted order by date and time with the newest file first. ls -R directory_name/by default the cwd is selected: Shows content of any specified directory recursively, if directory is not specified it will take the current working directory as a default argument. ...

pwd(Present working Directory): It shows the a user’s current working directory. pwd always returns the absolute path. Navigating directories: Absolute path: It is the full path starting from the top level path which is / to my current working directory. The absolute path will always start with / at the beginning. Relative path: It is not a full path but rather a path which depicts the location relative to our own current working directory. For example: we are in /home/user1 directory. To move upwards either we can write using the relative path like this → cd Desktop/ , or we can write using absolute path like this → cd /home/user1/Desktop/ ...

Volatile: Collecting hostname, date and time: hostname hostnamectl date cat /etc/timezone timedatectl epoch time: date +%s system uptime: uptime Network information: ip a # short form of ip addr show ifconfig # promisc mode detection: ifconfig eth0 ip link show eth0 # other network info commands: netstat -i netstat -rn # routing tables ip r # routing tables open port info: nmap -sT localhost nmap -sU localhost # UDP port sudo lsof -i tcp # checking tcp listening connections of localhost sudo lsof -n -P | grep LISTEN netstat -tulpn listing current user’s open processes: sudo lsof -u user_name mounted file system info: mount # info about file systems df -h # file systems info but in human readable format kernel module info, sound driver info: modinfo ufs # kernel module modinfo snd # sound module info user event collection: id Reading ELF file: readelf -h file_name # file header reading running processes: ps aux -ww swap area and disk partition info: cat /proc/partitions # disk partition cat /proc/swaps # swap info kernel message - kernel ring buffer info: dmesg Non-volatile: Collecting system info: cat /proc/cpuinfo cat /proc/self/mounts kernel info: uname -r cat /proc/version hostnamectl | grep Kernel local user account information: cat /etc/passwd cat /etc/passwd | cut -d: -f1 # seperating users from the output logged on user information: w last # login history information collecting system logs: cat /var/log/syslog cat /var/log/kern.log # linux kernel logs cat /var/log/fail.log cat /var/log/mail.* cat /var/log/mysql.* cat /var/log/daemon.log cat /var/log/debug journalctl history and hidden file information: history ls -al # hidden files suspicious info: sudo rkhunter --check --rwo sudo chkrootkit # rootkit checker file signature analysis: xxd file_name | head -n 10 basic file information: file file_name strings -t -d file_name # finding writable files inside /var/log directory : find / -writeable -type f 2> /dev/null | grep "/var/log" Directory permission checking: ls -ld Desktop File system analysis using The Sleuth Kit: Creating an file system image using dd: Important Before that add a virtual hard disk of 1gb for testing purpose on your vm through vmware -> vm settings -> add -> hard disk -> SCSI -> Create new virtual disk -> 1 gb -> Done. ...

Linux allocates unique pseudo (or virtual) numbered device files to represent terminal sessions opened by users on the system. It uses these files to communicate with individual sessions. By default, these files are stored in the /dev/pts (pseudo terminal session) directory. These files are created by the system when a user opens a new terminal session and they are removed on its closure. We can see it via the command tty(teletype)

The uptime command is used to display the system’s current time, length of time it has been up for, number of users currently logged in, and the average CPU (processing) load over the past 1, 5, and 15 minutes. The output shows the current system time (18:28:09), up duration (49 minutes), number of logged-in users (2), and the CPU load averages over the past 1, 5, and 15 minutes (0.00, 0.00, and 0.00), respectively. The load average numbers correspond to the percentage of CPU load with 0.00 and 1.00 represent no load and full load, and a number greater than 1.00 signifies excess load (over 100%).

You can clear the terminal screen using the command clear .

RHEL provides a set of tools that can be used to identify the absolute path of the command that will be executed when you run it without specifying its full path. These tools are the which, whereis, and type commands. which: whereis: type: