Linux for Hackers

Start read-only and orient: whoami, id and hostname for identity; uname -a and cat /etc/os-release to fingerprint the system; sudo -l to see what you may run as root; ip a and ss -tulpn for the network; and ps aux plus systemctl to see what is running. Save the output to a notes file.

The SUID bit makes a program run with its owner's privileges instead of the privileges of the user who launched it. It appears as an s where you would expect x in the owner block, for example -rwsr-xr-x. It is legitimate for tools like passwd, but a careless SUID program can become a path from a normal user to root.

Read it left to right. The first character is the type (- file, d directory, l link). The next nine are three groups of three for owner, group and others, each showing read (r), write (w) and execute (x). An s in place of x marks a SUID or SGID bit.

Root is the administrator account, always user id 0, with full control of the system. Sudo is a controlled way for a permitted normal user to run a single command with root's privileges after authenticating. Using sudo for one command is safer than logging in as root for everything.

You should be comfortable opening a terminal, but deep fluency is what this course builds. If the command line is completely new, start with the beginner Linux track first. This course moves faster and keeps a security angle on every topic, from the shell to the kernel.

Run ss -tulpn and read the users field, for example users:(("python3",pid=812)). That gives you the program name and its process id. From the pid you can inspect /proc/812/exe for the binary, /proc/812/cwd for its working directory and /proc/812/cmdline for the exact command line, including any config file path.