CTF Club · Meetup 01

Linux & GNU Commands for CTF players

Everything you need to go from zero to terminal-fluent. Built for beginners entering their first Capture the Flag competition.

bash — ctf@lab
$ ls -la
drwxr-xr-x 4 ctf ctf 128 Mar 14
-rw-r--r-- 1 ctf ctf 2048 Mar 14 readme.txt
-rw------- 1 ctf ctf 32 Mar 14 .secret
$ cat .secret
flag{h1dd3n_1n_pl41n_s1ght}
$
18
CTF Challenges
40+
Commands covered
5
Categories
0
Prerequisites

Linux is the language of CTF

Almost every CTF challenge lives on a Linux server, or hands you a file made on one. Learning the terminal is learning the home turf of every challenge author.

#!

Every category uses it

Forensics, pwn, web, crypto, misc — they all eventually put you at a command line. The terminal is the common thread.

|

Pipes are superpowers

Chain tools together. What takes 10 minutes of manual work collapses into one line: strings binary | grep flag{

$_

Speed wins competitions

The player who's fastest in the terminal often wins — not the smartest. Fluency is a skill you build with practice.

Command Reference

The commands every CTF beginner must know. ★ CTF marks the ones that appear most in real challenges.

pwdPrint current working directory
lsList files in the current directory
ls -laShow all files including hidden ones (.dotfiles) and permissions ★ CTF
cd <dir>Change into a directory
cd ..Go up one directory level
cd ~Go to your home directory
mkdir <dir>Create a new directory
clearClear the terminal screen (also: Ctrl+L)
man <cmd>Open the manual for any command — always check this first key
cat <file>Print the entire contents of a file ★ CTF
less <file>Scroll through large files — press q to quit
head -n 20Show the first 20 lines of a file
tail -n 20Show the last 20 lines of a file
cp src dstCopy a file from source to destination
mv src dstMove or rename a file
rm <file>Delete a file — no undo, be careful
touch <file>Create an empty file
wc -lCount the number of lines in a file
file <file>Detect the real file type — ignores the extension completely ★ CTF
strings <file>Extract all readable text from any binary file ★ CTF
xxd <file>Hex dump — inspect raw bytes and magic bytes
xxd -l 32Show only the first 32 bytes
base64 -dDecode a base64-encoded string
base64 <file>Encode a file to base64
stat <file>Show file size, timestamps, and full permissions detail
cmd1 | cmd2Pipe: send the output of cmd1 as input to cmd2 key
cmd > fileRedirect output to a file (overwrites)
cmd >> fileAppend output to an existing file
sortSort lines alphabetically
uniqRemove duplicate consecutive lines (use after sort)
uniq -cCount how many times each line appears ★ CTF
cut -d: -f2Extract field 2, using : as delimiter — great for structured data
tr a-z A-ZTranslate characters — e.g. lowercase to uppercase, ROT13 decoding
ls -laSee permissions on all files including hidden ones
chmod +x fileMake a file executable
chmod 644 fileOwner read/write, everyone else read-only
chmod 777 fileFull read/write/execute for everyone
chown user fileChange the owner of a file
sudo <cmd>Run a command as superuser (root)
idShow your current user ID and group memberships
whoamiPrint your current username

Core Concepts

The ideas behind the commands — understanding these makes every tool click.

01

The Pipe — chaining commands

The | symbol sends the output of one command directly into the next. This is the most powerful idea in Linux. You build complex operations by composing simple tools.

$ strings binary | grep "flag{"
flag{str1ngs_r3v3al_all}
02

Hidden Files — the dot prefix

Any file or folder whose name starts with a . is hidden from normal ls. CTF challenges love hiding flags here. Always use ls -la first.

$ ls → nothing
$ ls -la → .secret_flag.txt ✓
03

File Types — never trust extensions

A file called image.jpg might actually be a ZIP, a text file, or a binary. The file command reads magic bytes to tell you the truth.

$ file image.jpg
image.jpg: Zip archive data
04

Strings — reading binaries

Compiled binaries are mostly non-readable bytes, but they always contain readable text: error messages, hardcoded strings, and sometimes flags. strings extracts all of it.

$ strings vault | grep "flag{"
flag{str1ngs_unl0ck_s3cr3ts}
05

Recursive grep — search everywhere

When a flag could be in any file inside a directory, grep -r searches every file recursively. One command, entire directory tree.

$ grep -r "flag{" .
./configs/app.conf:flag{...}
06

Base64 — encoding ≠ encryption

Base64 is just encoding — anyone can decode it instantly. CTF challenges often "encode" data with base64 and expect you to decode it. It looks random but isn't.

$ echo "ZmxhZ3t..." | base64 -d
flag{b4s364_1s_3asy}

Linux Filesystem Map

Where things live on a Linux system — knowing this helps you know where to look in a CTF.

/ /Root of everything
├─ /home — User home directories★ flags often here
├─ /etc — Configuration files (passwd, shadow, ssh)★ juicy in CTF
├─ /tmp — Temporary files, world-writable★ good for uploads
├─ /var — Variable data: logs, databases, mail★ logs in /var/log
├─ /bin — Essential system binaries (ls, cat, grep)
├─ /usr — User programs and libraries
├─ /root — Root user's home directory★ often restricted
└─ /proc — Virtual filesystem, running process info

File Permissions

Read the permission string from ls -la — critical for privilege escalation challenges.

-
type
r
own
w
own
x
own
r
grp
-
grp
x
grp
r
all
-
all
-
all
r4Read — can view file contents
w2Write — can modify the file
x1Execute — can run as a program
-0Permission not granted

CTF Survival Tips

Hard-won advice for your first competition.

01

Always start with ls -la

Before doing anything else, list all files including hidden ones. Flags love hiding in .dotfiles and .hidden_directories. This takes 2 seconds and saves 20 minutes.

02

Never trust the file extension

A file called photo.jpg might be a ZIP, an ELF binary, or a plain text file with a flag. Always run file <filename> before doing anything else with an unknown file.

03

strings | grep "flag{" is your Swiss Army knife

Got an unknown binary? Run strings binary | grep "flag{" immediately. You'd be surprised how often this is all it takes. Try it on everything — pcaps, images, executables.

04

Base64 is not encryption

If you see a long string of letters and numbers ending in =, it's probably base64. Decode it immediately with echo "string" | base64 -d. It's encoding, not security.

05

Use find . -type f to map the territory

When you land in an unknown directory, run find . -type f immediately. This gives you a complete list of every file everywhere — including files in hidden subdirectories.

06

Tab completion and ↑ history are not optional

Press Tab to autocomplete commands and file paths. Press ↑ to recall previous commands. Search command history with history | grep <something>. Speed matters in competition.

External Resources

The best places to practice and go deeper.