Every task in the tabs above assumes you're not afraid to type instead of click. This page teaches the handful of commands you actually need. Read a section, try it in the terminal on the right, then move to the next one.
Every terminal command below is something you've already done a hundred times by clicking. Here's the exact same task, two ways:
| If you'd normally... | In the terminal, that's... |
|---|---|
| Double-click a folder to open it | cd foldername |
| Click the back / up arrow | cd .. |
| Look at what's in the current window | ls |
| Turn on "Show hidden files" | ls -a |
| Right-click → Properties / Get Info | ls -l |
| Double-click a text file to read it | cat filename |
| Use the search bar to find a file by name | find . -name "..." |
| Use Ctrl+F inside a document | grep "..." filename |
| The address bar showing where you are | pwd |
Unlike a file explorer with folders you can see, the terminal only shows you one thing at a time: whatever directory you're currently "in." pwd (print working directory) just tells you where that is.
pwd in the terminal now.ls lists everything in your current directory. Folders show up with a trailing slash. Add -a and you'll also see hidden files — anything starting with a dot.
ls, then ls -a.cd <folder> moves you into that folder. cd .. moves you back up one level. cd by itself (or cd ~) teleports you straight back home.
Documents, then check pwd.cat <filename> dumps a file's entire contents straight into the terminal.
Add -l and you get a permission string like -rwxr--r--: three chunks of three for owner, group, everyone else — read, write, execute. A file that's rwxrwxrwx means anyone can read, edit, and run it — usually a red flag.
Downloads — one file's permissions look unusually open.find <where> -name "<pattern>" searches an entire folder tree for files matching a name. Use * as a wildcard.
.txt file at once.grep "<text>" <file> searches inside a file's contents. Where find searches file names, grep searches what's written inside them.
You won't type these into this terminal, but you'll need them for Tasks B and C:
A device's address on a network — like a street address, but for computers. Looks like 192.168.1.14.
A number (0-65535) identifying which service on that device you're talking to. Port 80 = unencrypted web traffic, 443 = encrypted web traffic, 22 = remote terminal access.
nmap scans a device to find out which ports are open — "what's this machine actually running?" Wireshark captures the actual traffic on an IP/port, so you can see what's really being said.
Use ls, cd, cat, ls -a, find, grep to track down a hidden FLAG{...}.
Yesterday's workstation was compromised for real. IT pulled logs and files onto this machine for you to review. Use the same commands from Terminal Basics — nobody's showing you where to look this time.
access_summary.txt in your home directory. There's one login that doesn't belong. What time did it happen?cat access_summary.txt from your home directory. Look for the line without a badge scan.ls -l should make you suspicious of. What's the filename?ls -l.find . -name "*.sh" from home, then ls -l the folder it's in.Somewhere on this system, whoever did this left a message. Find it.
ls -a from your home directory.Below is a captured slice of network traffic — the same kind of data Wireshark shows you, just simplified. Someone logged into a company portal. Click any row to see more detail, then answer the questions.
| No. | Time | Source | Destination | Protocol | Length | Info |
|---|
nmap scans a target and reports which ports are open — which tells you what services that machine is actually running. Three targets below are on the same small network. Scan all three.
Every correct answer across all four tasks counts here — no matter which tab you're on when you solve it. Rank up as you go.