What the terminal is
The terminal (also called the shell or command line) is a text window where you type commands and the computer runs them. Instead of clicking icons, you tell the machine exactly what to do in words. Almost every server, security tool, and cloud system is controlled this way, so being comfortable at the command line is one of the most useful skills in cybersecurity. The program that reads your commands is the shell. The most common one is bash. You'll see the same commands below on Linux, on macOS, and on Windows through WSL or Git Bash.
Case matters
The terminal is case-sensitive. Notes.txt, notes.txt, and NOTES.TXT are three different files. Type names exactly.
Reading the prompt
Before you type anything, the shell shows a prompt. It tells you who you are, what machine you're on, and which folder you're in. A typical prompt looks like this:
So the whole prompt student@kali:~/labs$ reads as: the user student, on the machine kali, currently in the ~/labs folder, ready for a command.
Everywhere below, the $ stands for the prompt — you type only what comes AFTER it. The greyed-out lines are what the computer prints back.
Moving around the file system
Files live in folders (called directories), nested like a tree. These three commands are how you see where you are and move around.
| Command | What it does | Example |
|---|---|---|
| pwd | Print working directory — shows the full path of the folder you're in. | pwd |
| ls | List the files and folders in the current directory. | ls |
| ls -l | Long list: permissions, owner, size, and date for each item. | ls -l |
| ls -a | List all items, including hidden ones whose names start with a dot. | ls -a |
| cd <folder> | Change directory — move into the named folder. | cd labs |
| cd .. | Move up one level, to the parent folder. | cd .. |
| cd ~ | Go straight to your home folder from anywhere. | cd ~ |
| cd - | Jump back to the folder you were in last. | cd - |
Looking inside files
You'll spend a lot of time reading log files and data files. These print their contents without opening an editor.
| Command | What it does | Example |
|---|---|---|
| cat <file> | Print the whole file to the screen. Best for short files. | cat notes.txt |
| less <file> | Page through a long file. Arrow keys scroll; press q to quit. | less auth.log |
| head <file> | Show the first 10 lines of a file. | head auth.log |
| head -n 5 <file> | Show the first 5 lines (change 5 to any number). | head -n 5 auth.log |
| tail <file> | Show the last 10 lines of a file. | tail auth.log |
| tail -f <file> | Follow a file live — new lines appear as they're written. Great for watching logs. | tail -f auth.log |
| wc -l <file> | Count the number of lines in a file. | wc -l auth.log |
Creating and changing files
| Command | What it does | Example |
|---|---|---|
| mkdir <name> | Make a new directory (folder). | mkdir evidence |
| mkdir -p a/b/c | Make a folder and any missing parent folders in one step. | mkdir -p cases/2026/march |
| touch <file> | Create a new empty file (or update a file's timestamp). | touch report.txt |
| cp <src> <dest> | Copy a file to a new name or location. | cp report.txt backup.txt |
| cp -r <src> <dest> | Copy a whole folder and everything inside it. | cp -r evidence evidence-backup |
| mv <src> <dest> | Move a file, or rename it if the destination is a new name. | mv report.txt final-report.txt |
| rm <file> | Remove (delete) a file. There is no recycle bin — it's gone. | rm scratch.txt |
| rm -r <folder> | Remove a folder and everything inside it. | rm -r old-logs |
| echo "<text>" | Print a line of text to the screen. Later (in Chaining commands) you'll send it into a file with > instead. | echo "case opened" |
rm does not ask twice
rm deletes permanently — there is no trash to recover from. Double-check the name before you press Enter, and be extremely careful with rm -rf / and rm -rf *. In those commands / is the root of the entire file system (so rm -rf / tries to erase the whole machine), and * is a wildcard meaning "every file in the current folder." The -r flag deletes folders and their contents, and -f (force) skips the safety prompt — together they delete a lot, fast, with no confirmation.
Finding things
Two workhorses: find locates files by name; grep searches for text INSIDE files.
| Command | What it does | Example |
|---|---|---|
| find . -name "*.log" | Find every file ending in .log, starting in the current folder and searching all sub-folders. | find . -name "*.log" |
| grep "<text>" <file> | Print every line in the file that contains the text. | grep "FAILED" auth.log |
| grep -i "<text>" <file> | Search ignoring capitalization (matches Error, error, ERROR). | grep -i "error" auth.log |
| grep -r "<text>" <folder> | Search recursively through every file in a folder. | grep -r "password" . |
| grep -c "<text>" <file> | Count how many lines contain the text, instead of printing them. | grep -c "FAILED" auth.log |
Getting help
| Command | What it does | Example |
|---|---|---|
| man <command> | Open the full manual for a command. Press q to quit. | man ls |
| <command> --help | Print a quick summary of a command's options. | grep --help |
| history | Show the commands you've typed recently. | history |
| clear | Clear the screen (your history is not lost). | clear |
Chaining commands: pipes and redirection
The real power of the terminal is combining small commands into one line. A pipe ( | ) takes the output of the command on its left and feeds it as the input of the command on its right. Redirection ( > , >> ) sends output into a file instead of the screen. String enough of these together and you can answer a real question about a data file in a single command.
The operators that connect commands:
| Operator | What it does | Example |
|---|---|---|
| | | Pipe: send the output of the left command into the right command. | cat auth.log | grep "FAILED" |
| > | Redirect output into a file, replacing whatever was there. | grep "FAILED" auth.log > failures.txt |
| >> | Append output to the end of a file, keeping what's already there. | echo "reviewed" >> notes.txt |
| ; | Run several commands in order, one after another. | cd labs ; ls |
| && | Run the next command only if the previous one succeeded. | mkdir out && cd out |
A few more commands become powerful once you pipe into them:
| Command | What it does | Example |
|---|---|---|
| sort | Sort lines alphabetically (or by number with -n). | sort names.txt |
| uniq -c | Collapse repeated neighboring lines and count each. Sort first so duplicates are adjacent. | sort names.txt | uniq -c |
| cut -d',' -f1 | Split each line on a comma and keep field 1 — pulls one column out of a CSV. | cut -d',' -f1 users.csv |
Read a pipeline left to right, like a sentence. Each | hands its result to the next step, so the line below reads: *take the log, keep only the FAILED lines, pull out the username column, sort them, count how many times each name appears, then sort those counts from highest to lowest.*
Why this matters
That one line is real data analysis: filter, extract, group, and rank — the same steps a security analyst uses to spot a brute-force attack, and the same computational-thinking skills the AP Computer Science Principles exam tests when it asks you to extract information from data.
Try it yourself
access.logDownload access.log: https://restedteacher.com/practice-files/cybersecurity/access.log
A 100-line sample web-server log to practice on. Every IP address in it comes from a range reserved for documentation, so nothing in the file points at a real computer.
Get to the file first
Your browser saves the file to your Downloads folder. Move it into a labs folder and go there, using commands from this sheet:
mkdir -p ~/labs && mv ~/Downloads/access.log ~/labs/ && cd ~/labs
Then run ls and confirm you can see access.log. On WSL, your Windows Downloads folder is /mnt/c/Users/<your-name>/Downloads instead of ~/Downloads.
Using access.log, write ONE command for each question using pipes:
1. How many total lines are in the file? ( wc -l )
2. How many lines mention "error"? ( grep, ignore case )
3. List each unique IP address in the first column, with a count of how many times it appears, sorted from most to least. ( cut, sort, uniq -c, sort -nr )
Build each answer one pipe at a time: run the first command, check the output, then add the next | and run it again. That step-by-step habit is how professionals build long commands without guessing.