Linux Basics for Hackers - Study Flashcards

Comprehensive practice flashcards covering Linux fundamentals, file manipulation, networking, permissions, process management, shell scripting, services, anonymity, wireless attacks, kernel modules, job scheduling, and Python scripting for penetration testing.

According to the author, what is the rule of thumb for allocating system RAM to a virtual machine in VirtualBox?

Allocate no more than $25\%$ of your physical host's system RAM (for example, $1\,\text{GB}$ of RAM if the physical host has $4\,\text{GB}$, or $4\,\text{GB}$ if the host has $16\,\text{GB}$).

In the Linux filesystem hierarchy diagram shown, what symbol designates the root at the very top of the logical filesystem tree?

The forward slash (/), representing the root of the logical filesystem.

What is the primary difference between the whereis and which commands when searching for binaries in Linux?

whereis returns the path to the binary, its source code, and its man page, whereas which specifically returns only the location of the binary found within the directories listed in the PATH environment variable.

How do the wildcards ?, [], and * function when searching for files from the command line?

? represents a single character; [] matches characters specified within the square brackets; and * matches any character(s) of any length, from zero to an unlimited number of characters.

How do the head and tail commands differ, and how can the default number of displayed lines be changed?

head views the beginning of a file (defaulting to the first $10$ lines), whereas tail views the end of a file (defaulting to the last $10$ lines). Both can accept a dash followed by a number (such as -20) to modify the count of displayed lines.

What sed command syntax searches snort.conf to replace all occurrences of mysql with MySQL and outputs the result to snort2.conf?

sed s/mysql/MySQL/g /etc/snort/snort.conf > snort2.conf, where s indicates substitution, slashes separate search and replace terms, and g specifies global replacement.

What key advantages does less offer over the more command when viewing large files?

Unlike more, which only scrolls forward page by page, less allows scrolling both forward and backward at leisure and permits interactive term searching using the forward slash (/).

In the output of ifconfig, what do the interface identifiers eth0, lo, and wlan0 represent?

eth0 represents the first wired Ethernet connection, lo is the loopback interface (localhost, assigned 127.0.0.1), and wlan0 represents the first active wireless network interface card.

What three-step procedure is used to spoof a network card's MAC address using ifconfig?

First, take down the interface (ifconfig eth0 down); second, set the hardware address (ifconfig eth0 hw ether 00:11:22:33:44:55); third, bring the interface back up (ifconfig eth0 up).

When performing DNS reconnaissance with dig, what target information is obtained using the ns and mx options?

The ns option queries the target domain's nameservers, while the mx option queries the domain's mail exchange servers.

How does apt-get purge differ from apt-get remove when uninstalling software?

apt-get remove uninstalls the application binaries while retaining its configuration files, whereas apt-get purge removes both the application and all its configuration files.

What is the difference between running apt-get update and apt-get upgrade?

apt-get update only refreshes the list of available packages and versions from the repositories in sources.list, whereas apt-get upgrade downloads and installs the newer versions of installed software.

In Linux decimal permission notation, what numeric value represents read, write, and execute permissions (rwx), and how is it calculated?

The value is $7$, derived from adding the octal/binary weights of each permission: read (r) is $4$, write (w) is $2$, and execute (x) is $1$ ($4 + 2 + 1 = 7$).

What is the purpose of umask, and what default file and directory permissions result from Kali's default umask 022?

umask defines the permissions to subtract from base permissions ($666$ for files, $777$ for directories). A umask of $022$ results in default permissions of $644$ (rw-r--r--) for files and $755$ (rwxr-xr-x) for directories.

How do the SUID and SGID special permissions elevate a user's privileges during execution?

SUID allows any user to execute a file with the permissions of the file owner (such as root); SGID allows execution with the permissions of the file owner's group, or sets newly created files in a directory to inherit that directory's group ownership.

Which find command locates all files on the filesystem owned by root that have the SUID bit set?

find / -user root -perm -4000

What is the scale of nice priority values in Linux, and how do negative versus positive values affect process priority?

The nice scale ranges from $-20$ to $+19$, with $0$ as the default. A negative value increases process priority (allocating more resources), whereas a positive value decreases priority.

What are the signal numbers and behaviors for the default kill signal and the absolute kill signal in Linux?

The default kill signal is SIGTERM (signal $15$), which requests a process to terminate; the absolute kill signal is SIGKILL (signal $9$), which forces termination by sending the process's resources to /dev/null.

How can a process be started in the background from the terminal, and how can it be returned to the foreground?

Append an ampersand (&) to the command to run it in the background; use fg <PID> to bring that background process back to the foreground.

Why would an attacker or pentester set the environment variable HISTSIZE=0?

To prevent the terminal from recording commands in the session history file, eliminating bash command history evidence.

Why is the export command required when modifying an environment variable like HISTSIZE or PS1?

Without export, changes made to an environment variable only exist in the current shell session. export ensures that child processes and subshells inherit the updated variable.

What is the proper syntax for adding a directory /root/newhackingtool to the PATH variable without breaking system commands?

PATH=$PATH:/root/newhackingtool</code>. Omitting <code>$PATH: would overwrite the entire variable and cause all standard system commands located in /bin or /sbin to return a command not found error.

What vulnerability and port did hacker Max Butler (Max Vision) target to infiltrate restaurant networks?

The Aloha Point of Sale (POS) system's technical support backdoor running on port $5505$.

What is the difference between lossy and lossless compression, and which form must be used for scripts and executable code?

Lossy compression permanently discards data to achieve high compression ratios (common for .mp3 and .jpg), whereas lossless compression preserves exact data integrity. Lossless compression must be used for scripts, software, and executables.

Why is the dd command specifically valuable for computer forensics compared to ordinary copy tools like cp?

dd creates a bit-by-bit physical copy of a raw storage device rather than a logical filesystem copy, which preserves unallocated space and allows recovery of deleted files.

In Linux storage device nomenclature, what does the designation /dev/sda1 represent?

The first partition (1) on the first SATA or SCSI storage drive (sda).

How do block devices differ from character devices in /dev, and how are they identified in ls -l listings?

Character devices (c) transfer data stream-style character by character (e.g., keyboards, mice), whereas block devices (b) transfer data in high-speed blocks of bytes (e.g., hard disks, flash drives).

What is the three-part format of a logging rule in /etc/rsyslog.conf?

facility.priority action, where facility indicates the program generating the message, priority defines the severity threshold, and action designates the log file path or destination.

What does the command shred -f -n 10 /var/log/auth.log.* accomplish on a target system?

It forces permission changes (-f) and overwrites the authentication logs $10$ times (-n 10) to ensure they cannot be recovered by forensic investigators.

What is the default filesystem location where Apache2 serves its landing web page index.html?

/var/www/html/index.html

What is the default password for the root administrative user upon initial installation of MySQL/MariaDB in Kali?

The root user password is empty (blank).

What command connects the Metasploit console to an initialized PostgreSQL database named hackers_arise_db on localhost?

db_connect msf_user:password@127.0.0.1/hackers_arise_db

In proxychains.conf, how does dynamic_chain differ from random_chain?

dynamic_chain routes connections through proxies in the listed order and skips dead proxies automatically, whereas random_chain randomly selects a specified number of proxies (chain_len) from the list for each connection.

What command puts a wireless network adapter named wlan0 into monitor mode?

airmon-ng start wlan0

In the BlueZ protocol stack, what tasks are performed by hciconfig, hcitool, and sdptool?

hciconfig activates and queries local Bluetooth adapters; hcitool scans and probes for nearby Bluetooth devices; and sdptool inspects and queries the services supported by a target device.

How can packet forwarding for IPv4 be enabled temporarily via sysctl and permanently across reboots?

Temporarily: run sysctl -w net.ipv4.ip_forward=1. Permanently: uncomment net.ipv4.ip_forward=1 inside /etc/sysctl.conf and run sysctl -p.

What are the five time-and-date fields in an /etc/crontab entry from left to right?

Minute ($0$–$59$), Hour ($0$–$23$), Day of the month ($1$–$31$), Month ($1$–$12$), and Day of the week ($0$–$7$, where both $0$ and $7$ represent Sunday).

In Python network scripting with the socket module, which methods establish a connection and receive banner data?

s.connect((ip, port)) initiates the TCP handshake to the destination, and s.recv(1024) reads incoming bytes (such as the banner) from the socket.

Why is word.strip('\r\n') necessary when iterating over password lines in a Python password-cracking script?

Reading lines from a wordlist retains invisible newline and carriage return characters (\n and \r); failing to strip them appends them to the password attempt, causing authentication failures (false negatives).