Linux CLI Basics: First Day on the Cyber Operations Terminal

The official room banner for Linux CLI Basics. Image Credit: TryHackMe.

Introduction

Welcome to my walkthrough of the room Linux CLI Basics, an essential stepping stone in the Operating Systems Basics module within TryHackMe’s Pre Security path!

In our previous walkthrough, Windows Basics, we looked at how enterprise administrators manage corporate assets using desktop interfaces, graphical Settings menus, and system security suites. Today, we are completely ditching the mouse. In the cyber security landscape, Linux is the absolute standard — powering enterprise web servers, cloud containers, network monitoring appliances, and offensive hacking environments.

To defend networks or audit host logs, you must know how to communicate directly with the operating system kernel. In this guide, we step into a realistic hands-on simulation as a newly hired IT Support Engineer inside a fast-paced Cyber Operations Support Team, learning how to hunt for files, audit hardware allocations, and gather system intelligence using nothing but raw text commands.

Catch up on our previous article Windows Basics by reviewing the previous article below.

The official room banner for Windows Basics. Image Credit: TryHackMe.

What we will cover

• The Power of the CLI: Understanding why security professionals prioritize text terminals over graphical windows.
• File Tree Traversal Matrix: Mastering structural navigation commands, flag tags, and target location sweeps.
• Host Infrastructure Diagnostics: Auditing underlying system metrics, kernel distribution baselines, and storage configurations.

Room Information

Before we launch our command environment, let’s review the room parameters.

• Room Name: Linux CLI Basics
• Path: Pre Security
• Module: Operating Systems Basics
• Topic: Introduction / Walkthrough
• Difficulty: Easy
• Room Link: TryHackMe — Linux CLI Basics

Task 1: Introduction

Congratulations, today is your very first day on the job as an IT Support Engineer with the Cyber Operations Support Team! You were supposed to get a proper corporate introduction and a casual tour of the tools you’ll be using, but in the cybersecurity field, things rarely go according to plan.

Your supervisor had to rush out the door to handle an active, high-priority system incident. Before running out, they left a brief sticky note on your clean desk: you need to jump straight onto the live Linux workstation deployment, pull your mission briefs, and compile a foundational endpoint diagnostic report.

Faced with nothing but a blinking terminal prompt and a bit of mystery, it is time to build the hands-on baseline skills that cybersecurity professionals rely on every single day.

Questions and Answers

What does “CLI” stand for?

Answer:

command-line interface

Task 2: Navigation Mission: “Find the Missing Notes”

The terminal is a pure text-based interface used to control a Linux machine with absolute precision. Instead of wasting time clicking through layers of graphical menus, you type explicit commands that tell the computer exactly what to do. Cybersecurity specialists live in the terminal because it bypasses interface overhead, allows for rapid scripting, and is the only way to run the world’s most powerful security tools.

The Navigational Command Deck

To move through the hierarchical directory tree cleanly, you must master four foundational commands:

• pwd (Print Working Directory): Prints your exact absolute folder path location relative to the system root.
• ls (List): Prints the contents of your current directory. Appending flags like -l breaks out advanced metadata (permissions, sizes, timestamps), while -a unmasks hidden configuration files that start with a dot (.).
• cd (Change Directory): Shifts your current session path into a target folder (cd Documents), or drops you back down one step closer to the root tree (cd ..).
• find (Find): Recursively sweeps the system filesystem to locate objects matching precise query arguments (find <start_point> -name <target>).

Guided Walkthrough: Locating the Mission Brief

To kick off our assignment, we open the terminal shortcut from our desktop environment. We immediately query our current path using pwd and list out our standard home directory contents using ls.

Our supervisor mentioned leaving an active mission checklist file named mission_brief.txt hidden somewhere deep inside the profile path. Rather than manually clicking through every single directory, we leverage the power of the find utility, targeting the home directory abbreviation (~) as our search starting point. The terminal processes the query and exposes the absolute path to the file:

Executing pwd, ls, and find to track down the absolute file path.

The utility successfully mapped the path, exposing a hidden directory structure named .research hidden within the Documents folder.

We run a file read using the cat (concatenate) utility to dump the cleartext contents on our screen, uncovering our supervisor’s message and the hidden validation flag:

Running the cat command to read the mission brief contents and capture the flag.

Questions and Answers

What is the full path of the mission_brief.txt file found on the system using the find command?

Answer:

/home/ubuntu/Documents/.research/archive/mission_brief.txt

What is the flag hidden inside the mission_brief.txt file?

Answer:

MISSION-FOUND

Task 3: Investigating the System

Now that we have extracted our corporate brief, our next objective is to compile a localized endpoint diagnostic profile. Collecting system specifications helps security teams understand architecture limitations, patch revisions, and storage distributions before installing defense agents or triaging log data.

Environmental Diagnostics Toolkit

• whoami: Prints the literal username tied to your active shell session.
• uname -a: Queries the kernel properties to print the hostname, hardware processor architecture, and precise kernel patch generation.
• df -h: Outputs current storage volume layouts. The -h flag scales bytes up into easily readable megabytes (M) and gigabytes (G).

Guided Walkthrough: Generating the Diagnostics Log

To compile our required diagnostic report, we execute our reconnaissance commands sequentially directly inside our active prompt session. First, we identify our current session profile identity by querying the system kernel with whoami:

Verifying the current active shell session username.

Next, we extract the core infrastructure and host operating system release criteria by appending the comprehensive details flag to the uname command:

Querying detailed system kernel and architecture strings.

To audit the underlying storage device frameworks and capture the available capacity metrics, we utilize the human-readable disk utility flag:

Auditing local storage volume usage parameters.

Finally, we tackle the end-of-day milestone challenge. We combine our navigation toolkit to sweep the user profile structure for the missing document, and dump the validation log contents onto our workspace screen:

Executing find and cat to extract the final validation string.

Questions and Answers

What is the username returned by the whoami command?

Answer:

ubuntu

What is the kernel version shown by uname -a?

Answer:

6.14.0–1018-aws

How much free disk space does df -h report?

Answer:

58G

What is the message written inside day1_report.txt?

Answer:

END-OF-DAY1

Summary & Key Takeaways

Awesome job! You have successfully completed your first official shift on the Cyber Operations Support Team and taken your very first major steps into the Linux command-line matrix.

By moving away from graphical icons, you’ve learned how to quickly query paths with pwd, unmask hidden directories using ls -al, use find to extract hidden files across complex storage spaces, and audit endpoint specifications with uname and df. These fundamental blocks open the door to advanced administrative engineering — including access controls, process auditing, network pipe tracking, and scripting.

Key lessons:

• Terminal Speed & Control: Bypassing graphical user interfaces gives you raw, unmediated access to system functions, letting you automate tasks and run advanced tools instantly.
• The Power of Invisible Flags: Appending modifiers like -a to common commands reveals hidden file networks (.research, .backup). Malicious files and core configurations often use these hidden spaces to avoid notice.
• System Diagnostics Matter: Running baseline commands like uname and df is crucial before deploying security agents or performing incident response, ensuring you match the system’s exact operating parameters.

Linux CLI Basics: Room Complete.

Next up in the Operating Systems Basics module is Windows CLI Basics, where we will be executing text-based commands directly via the Command Prompt. Click the banner below to check it out!

The official room banner for Windows CLI Basics. Image Credit: TryHackMe.