Kali Linux Commands Cheat Sheet: Complete Quick Reference

This cheat sheet covers the essential Kali Linux commands every pentester and ethical hacker uses daily. It is organized by task so you can find what you need fast from navigating the file system to running your first nmap scan. Whether you’re a beginner setting up your first lab or a working professional on an engagement, keep this page bookmarked.

Tip: Bookmark this page. Come back whenever you need a fast Kali Linux command reference.

File and Directory Operations

Command	What It Does
ls	List files in the current directory
ls -la	List all files including hidden ones, with permissions and ownership
pwd	Print the current working directory
cd /path/to/dir	Change to a specific directory
cd ..	Move one directory up
mkdir dirname	Create a new directory
mkdir -p dir/sub/sub	Create nested directories in one command
rm filename	Delete a file
rm -rf dirname	Delete a directory and all its contents
cp file1 file2	Copy a file
mv file1 file2	Move or rename a file
touch filename	Create an empty file or update its timestamp
find / -name "*.conf"	Search for files by name from root
locate filename	Fast file search using a pre-built index

Pentesting tip: ls -la reveals hidden files (starting with .) and SUID bits. During post-exploitation, this is the first command you run to look for misconfigurations.

File Viewing and Editing

Command	What It Does
cat file	Print file contents to the terminal
cat /etc/passwd	Read the password file — lists all users
less file	View a file page by page (use q to quit)
head -n 20 file	Show the first 20 lines of a file
tail -n 20 file	Show the last 20 lines of a file
tail -f /var/log/auth.log	Follow a log file in real time
grep "root" /etc/passwd	Search for a pattern inside a file
grep -r "password" /etc/	Recursively search for a string in a directory
nano filename	Open a file in the nano text editor
vim filename	Open a file in Vim
diff file1 file2	Compare two files line by line
strings file	Extract printable strings from a binary file
xxd file	View file in hex dump format

Pentesting tip: strings and xxd are your first tools when you pick up an unknown binary in a CTF. tail -f is how you watch logs in real time during an active engagement.

File Permissions and Ownership

Command	What It Does
chmod 755 file	Set permissions (rwxr-xr-x) using numeric notation
chmod +x script.sh	Make a file executable
chmod -R 644 /var/www/	Recursively set permissions on a directory
chown user:group file	Change the owner and group of a file
chown -R www-data /var/www	Recursively change ownership
lsattr file	View special file attributes
chattr +i file	Make a file immutable — not even root can delete it
chattr +a file	Set append-only — useful for protecting log files
find / -perm -4000 2>/dev/null	Find all SUID binaries on the system
find / -perm -2000 2>/dev/null	Find all SGID binaries
find / -writable -type f 2>/dev/null	Find world-writable files

Pentesting tip: find / -perm -4000 is one of the most important privilege escalation checks. SUID binaries run as their owner, not the person executing them. Learn more about protecting files with the chattr command.

Process Management

Command	What It Does
ps aux	List all running processes with details
ps aux | grep apache	Filter processes by name
top	Interactive real-time process viewer
htop	Better interactive process viewer
kill 1234	Send SIGTERM to process ID 1234
kill -9 1234	Force kill a process (SIGKILL)
pkill nginx	Kill all processes matching the name
jobs	List background jobs in the current shell
bg %1	Resume job 1 in the background
fg %1	Bring job 1 back to the foreground
nohup command &	Run a command that survives terminal close
pgrep sshd	Get the PID of a running process by name

Pentesting tip: ps aux is the first thing you run after getting a shell to understand what’s running on the machine. nohup keeps your tools running even if your connection drops.

User and Group Management

Command	What It Does
whoami	Print the current user’s name
id	Show current user’s UID, GID, and all groups
who	Show who is currently logged in
w	Show who is logged in and what they are doing
last	Show recent login history
useradd -m username	Create a new user with a home directory
passwd username	Set or change a user’s password
usermod -aG sudo username	Add a user to the sudo group
userdel -r username	Delete a user and their home directory
su - username	Switch to another user (with their environment)
sudo -l	List commands the current user can run as sudo
cat /etc/passwd	View all users on the system
cat /etc/shadow	View hashed passwords (requires root)

Pentesting tip: sudo -l is a critical privilege escalation check. A surprising number of systems allow users to run commands as root without a password. The id command tells you immediately if you’re already in a privileged group.

Networking Commands

Command	What It Does
ip a	Show all network interfaces and IP addresses
ip route	Show the routing table
ping -c 4 8.8.8.8	Send 4 ICMP packets to test connectivity
netstat -tulnp	Show all listening TCP/UDP ports and their processes
ss -tulnp	Faster alternative to netstat
curl https://example.com	Fetch a URL from the terminal
wget https://example.com/file	Download a file
dig kalilinuxtutorials.com	Perform a DNS lookup
traceroute domain.com	Trace the route packets take to a host
arp -a	Show the ARP table (local network neighbors)
nc -lvnp 4444	Start a netcat listener on port 4444
ssh user@host	Connect to a remote host via SSH

Pentesting tip: ss -tulnp gives you a fast picture of all listening services after you land a shell. For active scanning, our nmap guide covers everything from SYN scans to NSE scripts.

System Information

Command	What It Does
uname -a	Print all system information (kernel, arch, OS)
uname -r	Print only the kernel version
hostnamectl	Show hostname, OS, kernel, and architecture
uptime	Show how long the system has been running
free -h	Show RAM and swap usage in human-readable format
df -h	Show disk usage per filesystem
du -sh /var/log/	Show size of a specific directory
lsblk	List block devices and partitions
cat /etc/os-release	Show OS name and version
cat /proc/version	Show kernel version from the proc filesystem

Pentesting tip: uname -r tells you the kernel version, which you cross-reference against known kernel exploits. Check the full uname command guide for every available flag.

Security-Specific Kali Linux Commands

Command	What It Does
nmap -sV -sC target	Run a version and default script scan
nmap -p- target	Scan all 65535 ports
nmap -O target	Attempt OS detection
nc -lvnp 4444	Open a reverse shell listener
python3 -c 'import pty; pty.spawn("/bin/bash")'	Upgrade a basic shell to a TTY
ufw status	Check the firewall status
ssh-keygen -t rsa -b 4096	Generate an RSA key pair
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt	Crack a hash with John the Ripper
hydra -l user -P rockyou.txt ssh://target	Brute force SSH credentials
searchsploit apache 2.4	Search ExploitDB for Apache exploits
msfconsole	Launch the Metasploit Framework

Pentesting tip: The Python3 PTY upgrade is essential after catching a reverse shell. A raw shell has no tab completion and no arrow keys. After spawning the PTY, press Ctrl+Z, run stty raw -echo; fg, then export TERM=xterm to get a fully interactive shell.

Quick Reference Summary

Task	Command
Find SUID binaries	find / -perm -4000 2>/dev/null
Check sudo permissions	sudo -l
List all open ports	ss -tulnp
Get current user and groups	id
Check kernel version	uname -r
Upgrade shell to TTY	python3 -c 'import pty; pty.spawn("/bin/bash")'
Start a netcat listener	nc -lvnp 4444
Scan a target with nmap	nmap -sV -sC target
Find writable directories	find / -writable -type d 2>/dev/null
Download a file	wget https://url/file
Extract a tar.gz archive	tar -xzvf archive.tar.gz
Install a tool	apt install toolname
Search exploit database	searchsploit keyword

This cheat sheet covers the commands you will actually use — in the terminal, on engagements, and in CTF competitions. Save it and come back whenever you need a quick lookup. Got a command that should be here? Drop it in the comments below.