Linux — The Hacker's Operating System

What you'll learn

• Why every server and security tool runs on Linux
• The command line: talking to the computer with text
• The essential commands you'll type forever
• File permissions — the heart of Linux security
• sudo and root — the most dangerous, most necessary command
• Chaining commands together with pipes

Talking instead of clicking 💬

On Windows you click icons. On Linux servers there are no icons — you type commands into a black window called the terminal. It feels alien for a day, then it becomes a superpower: precise, scriptable, and remote-friendly. ~90% of the world's servers run Linux, and nearly every security tool (Kali Linux, Wireshark, Metasploit) lives there.

The filesystem is a tree that starts at / (the root). You move around and inspect it with commands:

pwd              # "print working directory" — where am I?
ls               # list files here
ls -la           # list ALL files, long format (shows permissions)
cd /var/log      # change directory
cat access.log   # print a file's contents
grep "error" access.log   # find lines containing "error"

For security, grep is gold — it hunts through huge log files for exactly what you want.

Permissions are Linux's core defense. Every file says who can read, write, and execute it, for three groups: the owner, the group, and everyone else. In ls -la you see:

-rwxr-xr--
 │└┬┘└┬┘└┬┘
 │ │  │  └── others: read only
 │ │  └───── group: read + execute
 │ └──────── owner: read + write + execute
 └────────── file type

chmod changes those permissions. A classic mistake — making a private key world-readable — is exactly the kind of misconfiguration attackers scan for.

sudo and root — the master key 🔑

Every Linux system has a root user who can do anything — read any file, delete any file, install anything, break anything. Your everyday account is deliberately weaker, to protect you from your own mistakes (and from malware acting as you).

sudo ("superuser do") temporarily borrows root's power for one command:

cat /etc/shadow        # Permission denied — this file holds password hashes
sudo cat /etc/shadow   # Works — you've temporarily borrowed root's power

Why this matters for security specifically: a huge share of real attacks aren't about breaking in — they're about privilege escalation: an attacker gets a foothold as a low-privilege user, then hunts for a misconfigured sudo rule, a world-writable script that root runs, or a leaked root password to become root and own the entire machine. Defensively, the rule is least privilege (you met this idea before): give accounts only the sudo rights they truly need, never share the root password, and audit who can sudo regularly.

Real-world case study: chmod 777 🔍

One of the most common real-world misconfigurations security scanners find is a file or folder set to chmod 777 — permissions rwxrwxrwx, meaning everyone on the system can read, write, and execute it. Developers do this under deadline pressure when a permission error blocks them and 777 "just makes the error go away."

The problem: if that folder is reachable from the internet (a web upload directory, for example), an attacker who uploads any file can now also execute it — turning a simple file upload feature into full control of the server. The fix is always the same principle from this lesson: grant the minimum permission that works (usually 755 for folders, 644 for regular files — owner can write, everyone else can only read), never 777 as a "fix."

Summary

• Linux = the OS of servers and security; you drive it by typing in the terminal
• Core commands: pwd, ls -la, cd, cat, grep
• Permissions (rwx for owner/group/others) are Linux's built-in defense
• sudo/root and privilege escalation — why least privilege matters even more here
• chmod 777 is a classic, real-world misconfiguration attackers actively scan for

Do this: install Ubuntu in a free virtual machine (VirtualBox) or use WSL on Windows, and practice the commands above on real files. Next: Python, to automate all of this.