4.4 Useful Commands: Files, Search, Environment

Kali Linux Certified Professional KLCP

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 How to Use This Guide & Study Strategy 1.3 PEN-103 Syllabus & Study Path

2 About Kali Linux

2.1 A Bit of History: From BackTrack to Kali 2.2 Kali's Relationship with Debian 2.3 Purpose and Use Cases 2.4 Main Features and Design Policies

3 Getting Started with Kali Linux

3.1 Downloading and Verifying a Kali ISO 3.2 Booting Kali in Live Mode 3.3 Installation Options Overview 3.4 Troubleshooting Installations

4 Linux Fundamentals

4.1 What Linux Is and What It Does 4.2 The Command Line 4.3 The Filesystem Hierarchy Standard 4.4 Useful Commands: Files, Search, Environment

5 Permissions and Process Management

5.1 File Permissions and Ownership 5.2 Managing Processes 5.3 Shells, Variables, and the Environment

6 Installing Kali Linux

6.1 Minimal Installation Requirements 6.2 Step-by-Step Installation on a Hard Drive 6.3 Unattended Installations with Preseeding 6.4 ARM Installations

7 Configuring the Network, Users, and SSH

7.1 Configuring the Network 7.2 Managing Unix Users and Groups 7.3 Configuring SSH

8 Configuring Services

8.1 Apache Web Server 8.2 PostgreSQL Database 8.3 Managing Services with systemd

9 Helping Yourself and Getting Help

9.1 Documentation Sources 9.2 Kali Linux Communities 9.3 Filing Good Bug Reports

10 Security Policy and Network Services

10.1 Defining a Security Policy 10.2 Possible Security Measures 10.3 Securing Network Services

11 Firewalling and Monitoring

11.1 Netfilter and iptables Behavior 11.2 Writing iptables Rules and NAT 11.3 Monitoring and Logging

12 Debian Package Management: APT

12.1 Introduction to APT 12.2 The sources.list File 12.3 Kali Repositories 12.4 Basic Package Interaction with apt

13 dpkg and Advanced Package Management

13.1 dpkg Fundamentals 13.2 Inspecting .deb Files and Package State 13.3 Maintainer Scripts and Conffiles 13.4 APT Pinning and Package Authenticity

14 Advanced Usage

14.1 Modifying and Rebuilding Kali Packages 14.2 Recompiling the Kernel 14.3 Building Custom Kali Live ISO Images 14.4 USB Persistence with LUKS Encryption

15 Kali Linux in the Enterprise

15.1 Network Installation with PXE Boot 15.2 Configuration Management with SaltStack 15.3 Metapackages and Custom Repositories 15.4 Configuration Packages and Forking

16 Introduction to Security Assessments

16.1 Kali Linux in an Assessment 16.2 Types of Assessments 16.3 Types of Attacks 16.4 Formalization and the Road Ahead

4.4 Useful Commands: Files, Search, Environment

Key Takeaways Explain This Topic AI

cp needs -r to copy directories recursively, mv both moves and renames, and mkdir -p creates whole parent chains without errors

less is the preferred pager; head and tail -n control how many lines you see, and tail -f follows a growing log live

find walks the live filesystem (find / -name x -type f) while locate answers instantly from a database refreshed by updatedb

grep filters text with -i (case-insensitive), -r (recursive), -n (line numbers), -v (invert); which finds a command in PATH, whereis adds man pages and sources, and type resolves aliases and built-ins

tee writes output to a file and the screen at once (-a appends); df -h, du -sh, and free -h report disk and memory usage

Last updated: July 2026

Managing and Viewing Files

These are the commands you will type hundreds of times; the exam checks the options precisely.

ls lists directory contents: -l for the long format (permissions, owner, size, time), -a to include hidden dotfiles, -h for human-readable sizes, -t to sort by modification time.

cd changes directory; bare cd returns you home, cd - jumps back to the previous directory.

cp source dest copies files; copying a directory requires -r (recursive) , and -p preserves timestamps and permissions.

mv both moves and renames — mv old.txt new.txt renames in place; no -r is needed for directories.

mkdir creates directories; -p builds the whole chain ( mkdir -p engagement/scans/nmap ) without complaining about existing parts.

rm deletes files; rm -r recurses into a directory tree and rm -f forces past prompts, while rmdir removes only an already-empty directory. rm -rf has no undo, so read the path twice before you press Enter.

For viewing, cat dumps whole files (fine for short ones; -n numbers lines), but less is the real pager: scroll with arrows and Page Up/Down, search with /pattern , jump to the end with G , quit with q . head shows the first 10 lines and tail the last 10 by default; -n 50 changes the count, and tail -f /var/log/auth.log follows a growing file live — essential when watching logs during a brute-force attempt.

Searching: find vs. locate, and grep

find searches the live filesystem and takes a starting path plus tests and actions: find / -name report.pdf # exact name

• find /home -iname '*.txt' # case-insensitive glob
• find / -type f -size +100M # files over 100 MB
• find /etc -mtime -1 # modified in the last day

locate answers the same style of question almost instantly, but from a filename database , not the disk — so results can be stale or miss files created since the last refresh. Update the database with sudo updatedb before relying on it. Rule of thumb: locate for speed, find for accuracy and rich filters.

• grep filters text, either files or piped input: grep -i error /var/log/syslog # case-insensitive
• grep -rn 'password' /etc # recursive, with line numbers
• grep -v '^#' sshd_config # invert: drop comment lines
• ps aux | grep nmap # filter command output

Add -E for extended regular expressions (e.g. grep -E 'root|admin' file ).

Environment, Identity, and Disk Usage

Three commands locate a program: which nmap prints the path your shell would execute by searching PATH ; whereis nmap also lists man pages and source locations; type nmap is a shell built-in that reveals how the name resolves — alias, keyword, shell built-in, or external file ( type cd reports a built-in). Inspect the environment with echo $PATH or dump it all with printenv ; make a variable visible to child processes with export NAME=value .

For storage and memory triage: df -h shows free space per mounted filesystem, du -sh /var/log sums one directory's disk usage, and free -h reports RAM and swap. For system and hardware inventory: uname -a prints the kernel name, release, version and machine architecture; id shows your UID, GID and group memberships; dmesg dumps the kernel ring buffer and journalctl -u ssh.service queries the systemd journal ( -r newest-first, -f to follow, -b for this boot); and lspci and lsusb enumerate PCI and USB devices — lsusb being the quickest way to confirm that a USB Wi-Fi adapter really reached a Kali guest. file mystery.bin identifies a file's real type by inspecting magic bytes rather than trusting the extension — indispensable when triaging captured payloads. Finally, tee splits a stream so output goes to both the screen and a file, the standard way to keep evidence while watching a scan: nmap -sV target | tee scan.txt overwrites, and tee -a appends.

Combining the Commands

These tools become powerful in combination, joined by the pipe operator | which feeds one command's standard output into the next command's standard input. A classic investigation chain is du -sh /var/* | sort -h | tail -n 5 to find the five largest directories under /var , or find / -name '*.log' | xargs grep -l 'Failed password' to search every log file for failed logins ( xargs turns piped filenames into arguments for grep). When reading df -h , watch the Use% column for the filesystem mounted on / — a full root filesystem breaks updates and logging — while free -h answers a different question: the available column, not free , shows how much RAM applications can actually still claim, because Linux deliberately uses idle memory for disk cache. Knowing that distinction prevents misreading a healthy system as memory-starved, and it is exactly the kind of interpretation the exam probes.

Command Reference

• Command Purpose Key options / notes
• ls List directory contents -l long, -a hidden, -h human sizes
• cd Change directory bare = home, cd - = previous
• cp Copy files/directories -r recursive (required for dirs), -p preserve attrs
• mv Move or rename no -r needed for directories
• mkdir Create directories -p creates parent chain
• cat / less Dump / page file contents in less: / search, G end, q quit
• head / tail First / last lines (10 default) -n N count, tail -f follow
• find Live filesystem search -name , -iname , -type f , -size , -mtime
• locate Database filename search refresh with sudo updatedb
• grep Filter lines by pattern -i , -r , -n , -v , -E
• which / whereis / type Locate commands / resolve names type unmasks aliases and built-ins
• echo / printenv / export Inspect and share variables export for child processes
• df / du / free Disk and memory usage all take -h for human-readable
• file Identify file type by content ignores the extension
• tee Write to file and stdout -a append instead of overwrite

Learn the table cold: KLCP questions often present a task ('follow a log file as it grows' → tail -f , 'copy a directory tree' → cp -r ) and expect the exact command and flag.