Linux and SQL-1

OS

Windows, macOS, Linux, ChromeOS, Android, and iOS are all commonly used operating systems. Security analysts should be aware of vulnerabilities that affect operating systems. It’s especially important for security analysts to be familiar with legacy operating systems, which are systems that are outdated but still being used.

Unified Extensible Firmware Interface

CLI vs. GUI

A graphical user interface (GUI) is a user interface that uses icons on the screen to manage different tasks on the computer. A command-line interface (CLI) is a text-based user interface that uses commands to interact with the computer.

Linux architecture:

User: The person interacting with the computer and initiating tasks.
Applications: Programs that perform specific tasks on the computer.
Shell: The command-line interpreter that allows users to give commands to the kernel.
Filesystem Hierarchy Standard (FHS): Organizes data and specifies the location where data is stored in the operating system.
Kernel: Manages processes and memory, communicates with applications, and controls hardware functions. Takes input from shell and tells hardware.The contents and location of the new file are passed to the kernel. The kernel tells the hardware how and where to save this new file.
Hardware: The physical components of the computer, including peripheral devices and internal components like CPU, RAM, and hard drive.

Distributions:

Linux is a customizable operating system with different versions called distributions.
Understanding the distribution you're using is important to know what tools and apps are available.
The kernel is the most important component of the Linux OS, and it can be modified to create different distributions.
Different distributions serve different purposes, just like different vehicles serve different transportation needs.
Linux distributions have different preinstalled programs, user interfaces, and more.

ex : KALI LINUX derived from Debian. Some tools in Kali:

A package is a piece of software that can be combined with other packages to form an application. Packages can be managed using a package manager. There are multiple package managers and package management tools for different Linux distributions. Package management tools allow users to easily work with packages through the shell. Debian-derived Linux distributions use package managers like dpkg as well as package management tools like Advanced Package Tool (APT). Red Hat-derived distributions use the Red Hat Package Manager (RPM) or tools like Yellowdog Updater Modified (YUM).

The many different types of Linux shells include the following:

Bourne-Again Shell (bash)
C Shell (csh)
Korn Shell (ksh)
Enhanced C shell (tcsh)
Z Shell (zsh)
Previously, we learned about
the components of the Linux architecture.
The Filesystem Hierarchy Standard,
or FHS, is
the component of the Linux OS that organizes data.
This file system is
a very important part of Linux because
everything we do in Linux is considered
a file somewhere in the system's directory.
The FHS is a hierarchical system,
and just like with a tree,
everything grows and branches out from the root.
The root directory is
the highest-level directory in Linux.
It's designated by a single slash.
Subdirectories branch off from the root directory.
The subdirectories branch out
further and further away from the root directory.
When describing the directory structure in Linux, slashes
are used when tracing
back through these branches to the root.
For example, here,
the first slash indicates the root directory.
Then it branches out a level into the home subdirectory.
Another slash indicates it is branching out again.
This time it's to
the analyst subdirectory that is located within home.
When working in security,
it is essential that you learn to navigate
a file system to locate and analyze logs,
such as log files.
You'll analyze these log files for
Let's use these commands in Bash.
First, we'll type the command
pwd to display the current location and then press enter.
The output is the path to
the analyst directory where we're currently working.
Next, let's input ls to display
the files and directories within the analyst directory.
The output is the name of
four directories: logs, oldreports,
projects, and reports, and one file named updates.txt.
So let's say we now want to go into
the logs directory to check for unauthorized access.
We'll input: cd logs
to change directories.
We won't get any output
on the screen from the cd command,
but if we enter pwd again,
its output indicates that the working directory is logs.
Logs is a subdirectory of the analyst directory.

Standard FHS directories:

Directly below the root directory, you’ll find standard FHS directories. In the diagram, home, bin, and etc are standard FHS directories. Here are a few examples of what standard directories contain:

/home: Each user in the system gets their own home directory.
/bin: This directory stands for “binary” and contains binary files and other executables. Executables are files that contain a series of commands a computer needs to follow to run programs and perform other functions.
/etc: This directory stores the system’s configuration files.
/tmp: This directory stores many temporary files. The /tmp directory is commonly used by attackers because anyone in the system can modify data in these files.
/mnt: This directory stands for “mount” and stores media, such as USB drives and hard drives.

User-specific subdirectories

Under home are subdirectories for specific users. In the diagram, these users are analyst and analyst2. Each user has their own personal subdirectories, such as projects, logs, or reports.

Note: When the path leads to a subdirectory below the user’s home directory, the user’s home directory can be represented as the tilde (~). For example, /home/analyst/logs can also be represented as ~/logs.

You can navigate to specific subdirectories using their absolute or relative file paths. The absolute file path is the full file path, which starts from the root. For example, /home/analyst/projects is an absolute file path. The relative file path is the file path that starts from a user's current directory.

Note: Relative file paths can use a dot (.) to represent the current directory, or two dots (..) to represent the parent of the current directory. An example of a relative file path could be ../projects.

Key commands for navigating the file system

The following Linux commands can be used to navigate the file system: pwd, ls, and cd.

pwd

The pwd command prints the working directory to the screen. Or in other words, it returns the directory that you’re currently in.

The output gives you the absolute path to this directory. For example, if you’re in your home directory and your username is analyst, entering pwd returns /home/analyst.

Pro Tip: To learn what your username is, use the whoami command. The whoami command returns the username of the current user. For example, if your username is analyst, entering whoami returns analyst.

ls

The ls command displays the names of the files and directories in the current working directory. For example, in the video, ls returned directories such as logs, and a file called updates.txt.

Note: If you want to return the contents of a directory that’s not your current working directory, you can add an argument after ls with the absolute or relative file path to the desired directory. For example, if you’re in the /home/analyst directory but want to list the contents of its projects subdirectory, you can enter ls /home/analyst/projects or just ls projects.

cd

The cd command navigates between directories. When you need to change directories, you should use this command.

To navigate to a subdirectory of the current directory, you can add an argument after cd with the subdirectory name. For example, if you’re in the /home/analyst directory and want to navigate to its projects subdirectory, you can enter cd projects.

You can also navigate to any specific directory by entering the absolute file path. For example, if you’re in /home/analyst/projects, entering cd /home/analyst/logs changes your current directory to /home/analyst/logs.

Pro Tip: You can use the relative file path and enter cd .. to go up one level in the file structure. For example, if the current directory is /home/analyst/projects, entering cd .. would change your working directory to /home/analyst.

Common commands for reading file content

The following Linux commands are useful for reading file content: cat, head, tail, and less.

cat

The cat command displays the content of a file. For example, entering cat updates.txt returns everything in the updates.txt file.

head

The head command displays just the beginning of a file, by default 10 lines. The head command can be useful when you want to know the basic contents of a file but don’t need the full contents. Entering head updates.txt returns only the first 10 lines of the updates.txt file.

Pro Tip: If you want to change the number of lines returned by head, you can specify the number of lines by including -n. For example, if you only want to display the first five lines of the updates.txt file, enter head -n 5 updates.txt.

tail

The tail command does the opposite of head. This command can be used to display just the end of a file, by default 10 lines. Entering tail updates.txt returns only the last 10 lines of the updates.txt file.

Pro Tip: You can use tail to read the most recent information in a log file.

less

The less command returns the content of a file one page at a time. For example, entering less updates.txt changes the terminal window to display the contents of updates.txt one page at a time. This allows you to easily move forward and backward through the content.

Once you’ve accessed your content with the less command, you can use several keyboard controls to move through the file:

Space bar: Move forward one page
b: Move back one page
Down arrow: Move forward one line
Up arrow: Move back one line
q: Quit and return to the previous terminal window

common Linux commands:

pwd: Prints the current working directory.
ls: Lists the files and directories in the current directory.
cd: Changes the current directory.
mkdir: Creates a new directory.
touch: Creates a new file.
cp: Copies files and directories.
mv: Moves or renames files and directories.
rm: Removes files and directories.
cat: Displays the contents of a file.
head: Displays the first few lines of a file.
tail: Displays the last few lines of a file.
grep: Searches for a specific pattern in a file. For example, entering grep OS updates.txt returns all lines containing OS in the updates.txt
chmod: Changes the permissions of a file or directory.
sudo: Executes a command with administrative privileges.
man: Displays the manual pages for a command.
piping: (|). Piping sends the standard output of one command as standard input to another command for further processing. When used with grep, the pipe can help you find directories and files containing a specific word in their names. For example, ls /home/analyst/reports | grep users returns the file and directory names in the reports directory that contain users. Before the pipe, ls indicates to list the names of the files and directories in reports. Then, it sends this output to the command after the pipe. In this case, grep users returns all of the file or directory names containing users from the input it received.
Find : The find command searches for directories and file When using find, the first argument after find indicates where to start searching. For example, entering find /home/analyst/projects searches for everything starting at the projects directory. s that meet specified criteria.

Filtering for information

You previously explored how filtering for information is an important skill for security analysts. Filtering is selecting data that match a certain condition. For example, if you had a virus in your system that only affected the .txt files, you could use filtering to find these files quickly. Filtering allows you to search based on specific criteria, such as file extension or a string of text.

grep

The grep command searches a specified file and returns all lines in the file containing a specified string. The grep command commonly takes two arguments: a specific string to search for and a specific file to search through.

For example, entering grep OS updates.txt returns all lines containing OS in the updates.txt file. In this example, OS is the specific string to search for, and updates.txt is the specific file to search through.

Piping:

The pipe command is accessed using the pipe character (|). Piping sends the standard output of one command as standard input to another command for further processing. As a reminder, standard output is information returned by the OS through the shell, and standard input is information received by the OS via the command line.

The pipe character (|) is located in various places on a keyboard. On many keyboards, it’s located on the same key as the backslash character (\). On some keyboards, the | can look different and have a small space through the middle of the line. If you can’t find the |, search online for its location on your particular keyboard.

When used with grep, the pipe can help you find directories and files containing a specific word in their names. For example, ls /home/analyst/reports | grep users returns the file and directory names in the reports directory that contain users. Before the pipe, ls indicates to list the names of the files and directories in reports. Then, it sends this output to the command after the pipe. In this case, grep users returns all of the file or directory names containing users from the input it received.

Note: Piping is a general form of redirection in Linux and can be used for multiple tasks other than filtering. You can think of piping as a general tool that you can use whenever you want the output of one command to become the input of another command.

find

The find command searches for directories and files that meet specified criteria. There’s a wide range of criteria that can be specified with find. For example, you can search for files and directories that

Contain a specific string in the name,
Are a certain file size, or
Were last modified within a certain time frame.

When using find, the first argument after find indicates where to start searching. For example, entering find /home/analyst/projects searches for everything starting at the projects directory.

After this first argument, you need to indicate your criteria for the search. If you don’t include a specific search criteria with your second argument, your search will likely return a lot of directories and files.

Specifying criteria involves options. Options modify the behavior of a command and commonly begin with a hyphen (-).

-name and -iname

One key criteria analysts might use with find is to find file or directory names that contain a specific string. The specific string you’re searching for must be entered in quotes after the -name or -iname options. The difference between these two options is that -name is case-sensitive, and -iname is not.

For example, you might want to find all files in the projects directory that contain the word “log” in the file name. To do this, you’d enter find /home/analyst/projects -name "*log*". You could also enter find /home/analyst/projects -iname "*log*".

In these examples, the output would be all files in the projects directory that contain log surrounded by zero or more characters. The "*log*" portion of the command is the search criteria that indicates to search for the string “log”. When -name is the option, files with names that include Log or LOG, for example, wouldn’t be returned because this option is case-sensitive. However, they would be returned when -iname is the option.

Note: An asterisk (*) is used as a wildcard to represent zero or more unknown characters.

-mtime

Security analysts might also use find to find files or directories last modified within a certain time frame. The -mtime option can be used for this search. For example, entering find /home/analyst/projects -mtime -3 returns all files and directories in the projects directory that have been modified within the past three days.

The -mtime option search is based on days, so entering -mtime +1 indicates all files or directories last modified more than one day ago, and entering -mtime -1 indicates all files or directories last modified less than one day ago.

Note: The option -mmin can be used instead of -mtime if you want to base the search on minutes rather than days.

Manage directories and files:

Previously, you explored how to manage the file system using Linux commands. The following commands were introduced: mkdir, rmdir, touch, rm, mv, and cp. In this reading, you’ll review these commands, the nano text editor, and learn another way to write to files.

Creating and modifying directories

mkdir

The mkdir command creates a new directory. Like all of the commands presented in this reading, you can either provide the new directory as the absolute file path, which starts from the root, or as a relative file path, which starts from your current directory.

For example, if you want to create a new directory called network in your /home/analyst/logs directory, you can enter mkdir /home/analyst/logs/network to create this new directory. If you’re already in the /home/analyst/logs directory, you can also create this new directory by entering mkdir network.

Pro Tip: You can use the ls command to confirm the new directory was added.

rmdir

The rmdir command removes, or deletes, a directory. For example, entering rmdir /home/analyst/logs/network would remove this empty directory from the file system.

Note: The rmdir command cannot delete directories with files or subdirectories inside. For example, entering rmdir /home/analyst returns an error message.

rm -r subdirectory_name   for deleting all files in a dir

Creating and modifying files.

touch and rm

The touch command creates a new file. This file won’t have any content inside. If your current directory is /home/analyst/reports, entering touch permissions.txt creates a new file in the reports subdirectory called permissions.txt.

The rm command removes, or deletes, a file. This command should be used carefully because it’s not easy to recover files deleted with rm. To remove the permissions file you just created, enter rm permissions.txt.

Pro Tip: You can verify that permissions.txt was successfully created or removed by entering ls.

mv and cp

You can also use mv and cp when working with files. The mv command moves a file or directory to a new location, and the cp command copies a file or directory into a new location. The first argument after mv or cp is the file or directory you want to move or copy, and the second argument is the location you want to move or copy it to.

To move permissions.txt into the logs subdirectory, enter mv permissions.txt /home/analyst/logs. Moving a file removes the file from its original location. However, copying a file doesn’t remove it from its original location. To copy permissions.txt into the logs subdirectory while also keeping it in its original location, enter cp permissions.txt /home/analyst/logs.

Note: The mv command can also be used to rename files. To rename a file, pass the new name in as the second argument instead of the new location. For example, entering mv permissions.txt perm.txt renames the permissions.txt file to perm.txt.

nano text editor:

nano :is a command-line file editor that is available by default in many Linux distributions. Many beginners find it easy to use, and it’s widely used in the security profession. You can perform multiple basic tasks in nano, such as creating new files and modifying file contents.

To open an existing file in nano from the directory that contains it, enter nano followed by the file name. For example, entering nano permissions.txt from the /home/analyst/reports directory opens a new nano editing window with the permissions.txt file open for editing. You can also provide the absolute file path to the file if you’re not in the directory that contains it.

You can also create a new file in nano by entering nano followed by a new file name. For example, entering nano authorized_users.txt from the /home/analyst/reports directory creates the authorized_users.txt file within that directory and opens it in a new nano editing window.

Since there isn't an auto-saving feature in nano, it’s important to save your work before exiting. To save a file in nano, use the keyboard shortcut Ctrl + O. You’ll be prompted to confirm the file name before saving. To exit out of nano, use the keyboard shortcut Ctrl + X.

Note: Vim and Emacs are also popular command-line text editors.

Standard output redirection:

There’s an additional way you can write to files. Previously, you learned about standard input and standard output. Standard input is information received by the OS via the command line, and standard output is information returned by the OS through the shell.

You’ve also learned about piping. Piping sends the standard output of one command as standard input to another command for further processing. It uses the pipe character (|).

In addition to the pipe (|), you can also use the right angle bracket (>) and double right angle bracket (>>) operators to redirect standard output.

When used with echo, the > and >> operators can be used to send the output of echo to a specified file rather than the screen. The difference between the two is that > overwrites your existing file, and >> adds your content to the end of the existing file instead of overwriting it. The > operator should be used carefully, because it’s not easy to recover overwritten files.

When you’re inside the directory containing the permissions.txt file, entering echo "last updated date" >> permissions.txt adds the string “last updated date” to the file contents. Entering echo "time" > permissions.txt after this command overwrites the entire file contents of permissions.txt with the string “time”.

Note: Both the > and >> operators will create a new file if one doesn’t already exist with your specified name.

Search This Blog

The JK Journal