Why Master the Command Line?
If you're using Kali Linux, the command line isn't optional — it's where most of the work happens. Tasks that take minutes in a GUI can be done in seconds from the terminal, and many tools simply don't have a graphical interface at all.
Here's a one-line example: download an entire website with wget -r domain.com. Try doing that in a browser. The terminal is also where you'll run nmap, hashcat, aircrack-ng, sqlmap, and every other essential Kali Linux tool.
This cheatsheet is organized by task. Bookmark it and reference it as you work. You don't need to memorize everything — even seasoned Linux users keep references handy.
<angle brackets> should be replaced with your actual filename, directory, or value. <file> means a filename like notes.txt; <dir> means a directory like /home/kali.
Keyboard Shortcuts
These work in any bash terminal and will save you significant time:
| Shortcut | Action |
|---|---|
| Ctrl + Alt + T | Open a new terminal window (Kali desktop; Win + T also works) |
| Ctrl + L | Clear the terminal screen |
| Ctrl + C | Stop (kill) the currently running command |
| Ctrl + Z | Suspend (pause) the running command |
| Ctrl + R | Reverse search command history — extremely useful |
| Ctrl + A / Ctrl + E | Jump cursor to beginning / end of line |
| Ctrl + U / Ctrl + K | Cut everything before / after the cursor |
| Ctrl + W | Delete the last word |
| Ctrl + Y | Paste previously cut/yanked text |
| Ctrl + D | Log out of current session (or close shell) |
| Tab | Auto-complete filename or command |
| Tab Tab | Show all possible completions |
| ↑ / ↓ | Cycle through previous commands |
Essential Commands
| Command | Description |
|---|---|
| clear | Clear the terminal screen |
| reset | Reset the terminal (fixes display errors) |
| exit | Exit the current shell session |
| !! | Repeat the last command |
| sudo !! | Repeat the last command as root |
| history | Show command history |
| history | grep ssh | Search history for "ssh" |
| man <cmd> | Open the manual page for a command |
| which <cmd> | Show the path to a command's binary |
| whatis <cmd> | One-line description of a command |
File and Directory Navigation
| Command | Description |
|---|---|
| pwd | Print current working directory |
| ls | List files in current directory |
| ls -lah | Long listing, all files, human-readable sizes |
| ls -lt | Sort by modification time (newest first) |
| cd | Go to home directory |
| cd ~ | Go to home directory (explicit) |
| cd - | Go to previous directory |
| cd .. | Go up one directory |
| cd /etc | Go to absolute path |
| tree | Show directory tree (install: apt install tree) |
Working with Files & Directories
| Command | Description |
|---|---|
| mkdir <dir> | Create a directory |
| mkdir -p a/b/c | Create nested directories |
| touch <file> | Create empty file (or update timestamp) |
| cp <src> <dst> | Copy file |
| cp -r <dir1> <dir2> | Copy directory recursively |
| mv <src> <dst> | Move or rename a file/directory |
| rm <file> | Delete a file |
| rm -rf <dir> | Force delete directory and contents (⚠️ careful) |
| ln -s <target> <link> | Create a symbolic link |
| file <file> | Identify file type |
| stat <file> | Detailed file metadata |
rm -rf: This command does not ask for confirmation and cannot be undone. Especially never run rm -rf / or rm -rf /* — these will destroy your system.
Viewing File Contents
| Command | Description |
|---|---|
| cat <file> | Print entire file to terminal |
| less <file> | View file with pagination (q to quit, /search) |
| head -n 20 <file> | Show first 20 lines |
| tail -n 20 <file> | Show last 20 lines |
| tail -f /var/log/syslog | Follow a log file in real time |
| wc -l <file> | Count lines in file |
| diff <file1> <file2> | Compare two files |
| nano <file> | Open file in nano editor |
| vim <file> | Open file in vim editor |
Searching Files & Text
The find and grep commands are two of the most powerful tools in your arsenal:
| Command | Description |
|---|---|
| find . -name "*.txt" | Find all .txt files in current dir and subdirs |
| find / -type f -size +100M | Find files larger than 100 MB |
| find / -mtime -7 | Find files modified in last 7 days |
| find . -name "*.conf" -exec grep "port" {} \; | Find files and grep within them |
| grep "pattern" <file> | Search for pattern in file |
| grep -r "pattern" /etc | Recursive search through directory |
| grep -i "pattern" <file> | Case-insensitive search |
| grep -v "pattern" <file> | Invert match (lines NOT matching) |
| grep -E "regex" <file> | Use extended regex |
| locate <name> | Fast filename search (run updatedb first) |
Text Processing (sed, awk, sort, uniq)
| Command | Description |
|---|---|
| sort <file> | Sort lines alphabetically |
| sort -n <file> | Sort numerically |
| sort -u <file> | Sort and remove duplicates |
| uniq <file> | Remove adjacent duplicate lines |
| cut -d ',' -f 1 <file> | Extract first CSV column |
| tr 'a-z' 'A-Z' < <file> | Convert lowercase to uppercase |
| sed 's/old/new/g' <file> | Find/replace in file output |
| sed -i 's/old/new/g' <file> | Find/replace in place (modify file) |
| awk '{print $1}' <file> | Print first column of each line |
| awk -F: '{print $1}' /etc/passwd | Use : as field separator |
File Permissions & Ownership
| Command | Description |
|---|---|
| chmod 755 <file> | rwxr-xr-x — owner full, others read+execute |
| chmod 644 <file> | rw-r--r-- — owner read+write, others read |
| chmod +x <file> | Add execute permission for all |
| chmod -R 755 <dir> | Recursive permission change |
| chown user:group <file> | Change owner and group |
| chown -R user:group <dir> | Recursive ownership change |
| umask 022 | Set default permission mask |
755 = 7 (rwx) + 5 (r-x) + 5 (r-x).
Process Management
| Command | Description |
|---|---|
| ps aux | List all running processes |
| ps aux | grep nginx | Find specific process |
| top | Real-time process viewer |
| htop | Interactive process viewer (better than top) |
| kill <PID> | Terminate process by PID |
| kill -9 <PID> | Force kill (SIGKILL) |
| pkill <name> | Kill processes by name |
| killall <name> | Kill all processes with that name |
| jobs | List background jobs in current shell |
| bg / fg | Send job to background / bring to foreground |
| nohup <cmd> & | Run command, immune to hangups |
| screen / tmux | Persistent terminal sessions |
Service Management (systemd)
Modern Linux uses systemd for service management. The old service command still works but is just a wrapper:
| Command | Description |
|---|---|
| systemctl status ssh | Show service status |
| systemctl start ssh | Start a service |
| systemctl stop ssh | Stop a service |
| systemctl restart ssh | Restart a service |
| systemctl enable ssh | Enable service to start at boot |
| systemctl disable ssh | Disable auto-start at boot |
| systemctl list-units --type=service | List all running services |
| journalctl -u ssh | View logs for a service |
| journalctl -xe | Jump to the newest log entries, with explanations |
| journalctl -f | Follow logs in real time |
Networking Commands
The classic ifconfig and netstat commands are deprecated in favor of ip and ss. They still work on Kali but the modern equivalents are preferred. Full mapping: ifconfig → ip addr, route → ip route, arp → ip neigh, netstat → ss.
Two things worth knowing. The old tools come from the net-tools package, which is present on standard Kali installs but often missing from Docker, WSL, and other minimal images — if ifconfig is "not found" there, that is why (sudo apt install net-tools). Separately, iwconfig is not part of net-tools: it belongs to wireless-tools and uses the old Wireless Extensions API. Its modern replacement is iw, which is what you want for anything current.
| Command | Description |
|---|---|
| ip addr show | Show all network interfaces (replaces ifconfig) |
| ip a | Short form of the above |
| ip link set eth0 up | Bring interface up |
| ip route show | Show routing table (replaces route) |
| ss -tulpn | Show listening ports + processes (replaces netstat) |
| ss -tan state established | Show all established TCP connections |
| ping <host> | Send ICMP echo to host |
| traceroute <host> | Show routing path to host |
| dig <domain> | DNS lookup |
| dig +short <domain> | Short DNS output |
| nslookup <domain> | Alternative DNS lookup |
| whois <domain> | Domain registration info |
| curl -I <url> | Fetch HTTP headers only |
| curl -O <url> | Download file keeping name |
| wget <url> | Download file |
| wget -r <url> | Recursive download (mirror site) |
| nc -lvnp 4444 | Netcat listener on port 4444 |
SSH & Remote Access
| Command | Description |
|---|---|
| ssh user@host | SSH login |
| ssh -p 2222 user@host | SSH on custom port |
| ssh -i ~/.ssh/key user@host | SSH with specific key |
| ssh-keygen -t ed25519 | Generate SSH key pair |
| ssh-copy-id user@host | Copy public key to remote host |
| scp file user@host:/path | Copy file to remote host |
| scp -r dir user@host:/path | Copy directory recursively |
| scp user@host:/path/file . | Download file from remote |
| rsync -avz src/ user@host:/dst | Efficient sync over SSH |
Package Management (apt)
| Command | Description |
|---|---|
| sudo apt update | Refresh package list |
| sudo apt upgrade | Upgrade all installed packages |
| sudo apt full-upgrade | Full upgrade (may remove obsolete packages) |
| sudo apt install <pkg> | Install a package |
| sudo apt remove <pkg> | Uninstall a package |
| sudo apt purge <pkg> | Uninstall + remove config files |
| sudo apt autoremove | Remove unused dependencies |
| apt search <keyword> | Search for packages |
| apt show <pkg> | Show package details |
| dpkg -l | grep <pkg> | List installed packages matching name |
| dpkg -i package.deb | Install a .deb file directly |
| sudo apt modernize-sources | Convert sources.list to the new deb822 format |
full-upgrade, not upgrade. Kali is a rolling release, so packages frequently need to be removed to let newer ones in — something plain apt upgrade will never do. Kali's own documentation puts it bluntly: apt upgrade "isn't really useful, and can even be counter-productive." The standard pair is sudo apt update && sudo apt full-upgrade -y. The one caveat: full-upgrade can remove something important, so read the list of packages to be removed before confirming.
/etc/apt/sources.list. Fresh Kali 2026.2+ installs instead use the deb822 format at /etc/apt/sources.list.d/kali.sources. Systems upgraded from earlier releases keep the old file and are not converted automatically — run sudo apt modernize-sources to migrate. If you edit the old file on a new install and nothing changes, this is why.
System & Hardware Info
| Command | Description |
|---|---|
| uname -a | Kernel and system info |
| uptime | System uptime and load average |
| free -h | Memory usage (human-readable) |
| df -h | Disk space usage |
| du -sh <dir> | Directory size |
| du -sh * | sort -h | Sort subdirectories by size |
| lsblk | List block devices (disks) |
| fdisk -l | List disk partitions |
| lsusb | List USB devices |
| lspci | List PCI devices |
| lscpu | CPU info |
| dmesg | tail | Recent kernel messages |
| cat /etc/os-release | OS version info |
User Management
| Command | Description |
|---|---|
| whoami | Show current username |
| id | Show user/group IDs |
| w | Show currently logged-in users |
| last | Show login history |
| sudo useradd -m <user> | Create user with home directory |
| passwd | Change your own password |
| sudo passwd <user> | Set/change user password |
| sudo usermod -aG sudo <user> | Add user to sudo group |
| sudo userdel -r <user> | Delete user and home dir |
| su - <user> | Switch to another user |
| sudo -i | Get a root shell |
Archives & Compression
| Command | Description |
|---|---|
| tar -czvf archive.tar.gz <dir> | Create gzipped tar archive |
| tar -xzvf archive.tar.gz | Extract gzipped tar |
| tar -xjvf archive.tar.bz2 | Extract bzip2 tar |
| zip -r archive.zip <dir> | Create zip archive |
| unzip archive.zip | Extract zip |
| gzip <file> | Compress file (creates .gz) |
| gunzip <file>.gz | Decompress .gz file |
Pentesting Quick Reference
Common Kali-specific commands you'll use during security testing:
| Command | Description |
|---|---|
| nmap -sV <target> | Service version scan |
| nmap -sC -sV -p- <target> | Full port scan with default scripts |
| nmap -A <target> | Aggressive scan (OS, version, scripts) |
| masscan -p1-65535 10.0.0.0/8 | Ultra-fast port scanner |
| tcpdump -i eth0 -w cap.pcap | Capture packets to file |
| tcpdump -i eth0 port 80 | Capture HTTP traffic |
| airmon-ng start wlan0 | Enable monitor mode on WiFi |
| airodump-ng wlan0mon -c 11 | Monitor channel 11 traffic |
| aircrack-ng cap.cap -w wordlist.txt | Crack WPA2 handshake |
| hashcat -m 0 hash.txt rockyou.txt | Hashcat dictionary attack |
| hydra -l user -P pass.txt ssh://<ip> | SSH brute-force |
| gobuster dir -u <url> -w <wordlist> | Directory bruteforce |
| sqlmap -u "<url>?id=1" --dbs | SQL injection scan |
| msfconsole | Launch Metasploit framework |
Pro Tips
A few habits that will save you hours:
- Use
Ctrl + Rto search command history. Type a few characters and it finds matching past commands. Press Enter to run, or arrows to edit. - Pipe and chain commands:
ps aux | grep nginx | awk '{print $2}'finds nginx PIDs. - Redirect output:
command > filewrites to a file,command >> fileappends,command 2>&1merges error stream. - Use
&&and||:cmd1 && cmd2runs cmd2 only if cmd1 succeeds. - Aliases: Add
alias ll='ls -lah'to your shell config to create shortcuts. On Kali that file is~/.zshrc, not~/.bashrc— see the Zsh note below. - Read the manual: almost every command ships with one. Run
man lsto see exactly what a command does and every flag it takes (pressqto quit). - Background jobs: append
&to run a command in background, thenjobsto list them. - Tab completion works for files, commands, and even arguments — use it constantly.
~/.zshrc rather than ~/.bashrc. If you add an alias to ~/.bashrc on Kali and it disappears when you reopen the terminal, that is why.
To switch shells:
chsh -s /bin/bash (to Bash) or chsh -s /bin/zsh (back to Zsh), then log out and back in. You can also do it from kali-tweaks under Shell & Prompt, which is the same place you switch between the two-line and one-line prompt. In a running Zsh session, Ctrl + P toggles that prompt style instantly.
Frequently Asked Questions
Should I use ifconfig or ip?
Use ip for new scripts. ifconfig still works on Kali but is deprecated and may eventually be removed. The ip command is more powerful and is part of the actively-maintained iproute2 package.
What's the difference between sudo and su?
sudo runs a single command as root using your own password. su - switches to a full root shell using root's password (which is disabled by default on modern Kali). Use sudo -i to get a root shell using your password.
How do I find a file when I don't remember its name?
If you know part of the name: find / -iname "*partial*" 2>/dev/null. If you don't, but you know it contains specific text: grep -r "text" /path 2>/dev/null. The 2>/dev/null hides "permission denied" errors.
How do I run a command in the background and keep it running after logout?
Use nohup <command> & or run it inside a tmux or screen session. tmux is the modern choice — start with tmux new -s work, detach with Ctrl+B D, reattach later with tmux attach -t work.
What's the fastest way to repeat a previous command?
!! repeats the last command. !ssh runs the last command starting with "ssh". Press ↑ to scroll through recent commands, or Ctrl+R to search history interactively.
Why do some tools behave differently when I forget sudo?
Since Kali 2020.1 you log in as a normal user, not root, and some tools change behaviour rather than failing loudly. Nmap is the documented example, and it works two different ways depending on how you call it. Ask for a SYN scan explicitly without root and it refuses outright: nmap -sS returns "You requested a scan type which requires root privileges. QUITTING!". Run plain nmap <target> as a normal user and nothing errors at all — the default scan quietly changes from the SYN scan (root) to the slower TCP connect scan, which completes the full handshake and is noisier. So if a scan feels slow or your output does not match a tutorial, check whether the guide assumed sudo.
What does sudo mean in Linux?
Sudo runs a single command with root (administrator) powers. Many actions, like installing software or changing system files, need root. Putting sudo in front of a command grants those powers for that one command only, then drops them again — which is much safer than working as root all the time.
How many Linux commands do I need to know as a beginner?
About 30 commands cover most daily work in Kali Linux. The core ones on this page — navigating folders, reading files, searching with grep, installing software with apt, and basic networking with ip and ping — are enough to follow almost any beginner tutorial. You learn the rest as you need them, not all at once.
What is the difference between apt update and apt upgrade?
apt update refreshes the list of available packages but installs nothing. apt upgrade actually installs the newer versions. On Kali you should use full-upgrade instead of plain upgrade, because Kali is a rolling release and full-upgrade handles the package changes correctly. Always run update first, then full-upgrade.
Why does my script say "permission denied" when I try to run it?
The file does not have the execute permission yet. Run chmod +x yourscript.sh to make it runnable, then start it with ./yourscript.sh. This is one of the most common beginner problems and the fix is almost always chmod +x.
Does Kali Linux use Bash or Zsh?
Modern Kali uses Zsh as the default shell, not Bash. For everyday commands this makes no difference — every command on this page works the same in both. The main thing to know is that your shell settings and aliases live in ~/.zshrc rather than ~/.bashrc.
