Kali Linux Commands: A Beginner's Cheat Sheet (2026)

What Are Kali Linux Commands?

Kali Linux commands are standard Linux shell commands running on a Debian-based distribution that ships with several hundred preinstalled security tools. There is no separate "Kali command language." The commands you learn here work identically on Ubuntu, Debian, and the compromised web server you land a shell on during a CTF.

That last part is the reason this matters more than it looks. When you pop a reverse shell on a target, you do not get Kali. You get whatever cramped shell that machine has, and the only thing you carry across is the command vocabulary in your head. Beginners who lean on graphical tools stall the moment the GUI is gone.

Kali itself is a rolling release, so there is no "Kali 2026" edition to migrate to. The most recent snapshot image at the time of writing is 2026.2, released 29 June 2026, but a machine that has been updated this week is on the same packages regardless of which image it started from. The official tool listing covers what comes preinstalled.

One honest note before the command lists. Kali's own documentation says that if you are looking for "a Linux distribution to use as a learning tool to get to know your way around Linux," then "Kali Linux is probably not what you are looking for". That is fair. Kali is a loaded toolbox, not a tutor. You learn the commands below and then Kali becomes useful, not the other way around.

Start Here: The Kali Defaults That Trip Up Beginners

Four defaults account for most of the confusion in a beginner's first hour.

• You are not root. Kali switched to a non-root user policy in the 2020.1 release. The prebuilt VM and live images log in as kali with the password kali, per the official default credentials page. Anything privileged needs sudo in front of it.
• Your shell is zsh, not bash. Kali made ZSH the default in 2020.4. Almost everything behaves the same, but if a tutorial's script misbehaves, that is usually why. Run chsh -s /bin/bash to switch back, or just add #!/bin/bash to your scripts and move on.
• Tab completion is not optional. Type three characters and press Tab. Press it twice to see every match. Nobody who is fast at the terminal types full paths.
• Your history is searchable. Ctrl+R then a few characters pulls back any command you have run. This one shortcut saves more time than any tool you will install this year.

Then run three commands to orient yourself on any fresh machine: whoami to see who you are, id to see which groups that gets you, and uname -a for the kernel and architecture. On a target box those three are also your first privilege escalation notes.

Finally, update before you do anything else. On Kali that means sudo apt update && sudo apt full-upgrade -y, not plain apt upgrade, because a rolling release constantly changes dependencies. Our guide to updating Kali Linux safely covers what breaks when you skip this for three months.

Navigation and File Commands: Your First Ten Minutes on a Box

Every box starts the same way. Where am I, what is here, and what can I read?

• pwd prints your current directory. Trivial, and you will use it constantly once you are three levels deep in someone else's web root.
• ls -la is the only version of ls worth muscle memory. The -a shows dotfiles, which is where the interesting things live: .bash_history, .ssh/, .env, .git/. Plain ls hides all of them.
• cd - jumps back to the previous directory. cd with no argument goes home.
• cat file dumps a file to the screen. Fine for short files, terrible for a 40,000-line log.
• less file is the one to use for anything long. Arrow keys and PageUp/PageDown scroll, /pattern searches, q quits.
• head -n 20 file and tail -n 20 file show the first or last lines. tail -f follows a log live, which is how you watch your payload land.
• file something tells you what a file actually is. In CTFs this is a first move, because a challenge named image.jpg is frequently a ZIP archive wearing a hat.
• wc -l file counts lines. Useful for sanity-checking wordlists before you point a tool at them.

Finding Files and Text: grep and find

These two commands do more real work in security than any scanner. Learn them properly and you will out-enumerate people with far more tooling.

grep searches inside files. The flag combination worth memorizing is -rin: recursive, case-insensitive, with line numbers.

grep -rin "password" /var/www/ 2>/dev/null

That one line has found more credentials in more CTFs than any exploit. Add --include="*.php" to cut the noise, or -l to list matching filenames instead of the matches themselves.

find searches for files by their properties. It has an unfriendly syntax and it is worth pushing through anyway.

find / -perm -4000 -type f 2>/dev/null

That lists every SUID binary on the system, which is the classic opening move for Linux privilege escalation. Other patterns you will reuse: find / -name "*.conf" -mtime -7 for recently modified config files, and find / -writable -type d 2>/dev/null for directories you can write to.

Note the 2>/dev/null on the end of both. It throws away the flood of "Permission denied" errors so the actual results stay readable. Get in the habit of appending it to any command you run as a low-privileged user.

Skip locate. It queries a database that is often stale or missing on a target, and beginners waste an hour wondering why it returns nothing. find is slower and always tells the truth.

Permissions, Users, and the 777 Trap

Linux permissions are three groups of three bits: read, write, execute, for owner, group, and everyone else. The numeric form adds them up, so read (4) plus write (2) plus execute (1) is 7.

• chmod +x script.sh makes a file executable. This is the fix for roughly half of all "permission denied" messages a beginner hits.
• chmod 600 id_rsa is required before SSH will accept a private key. SSH refuses keys that other users can read, and the error message does not say so clearly.
• chown user:group file changes ownership. Needs root.
• id shows your user ID and every group you belong to. Membership in docker, lxd, or disk is effectively root access on many systems.
• sudo -l lists what you are allowed to run with sudo. If you learn one privilege escalation command, learn this one.
• cat /etc/passwd enumerates local users. It is world-readable by design, and it tells you which accounts have real shells and which are service stubs.

About chmod 777: it grants read, write, and execute to every user on the system. It appears in a lot of tutorials as a quick fix for a permissions error, and it is the wrong fix every time. On your own throwaway VM it is merely sloppy. On anything shared, it is the misconfiguration your future self will exploit.

In practice, sudo -l is where most beginner privilege escalation actually starts. If it comes back with something like (ALL) NOPASSWD: /usr/bin/find, check that binary on GTFOBins, which catalogs how ordinary Unix binaries can be pushed into giving you a shell. Our Linux privilege escalation guide walks the full checklist.

Networking Commands You Run on Every Target

The old commands here have been deprecated for years, and half the tutorials on the internet have not noticed. Learn the current ones.

• ip a shows your interfaces and IP addresses. This replaced ifconfig, which is not installed by default on many modern systems.
• ip route shows your routing table, including the default gateway. On a target, the gateway often points at the next network worth exploring.
• ss -tulpn lists listening TCP and UDP ports with the process behind each one. This replaced netstat -tulpn. Same flags, faster, actually maintained.
• curl -I https://example.com fetches only the response headers. Add -v for the full exchange, -L to follow redirects, and -k to accept a self-signed certificate on a lab box.
• wget URL downloads a file. Use it over curl when you want the file on disk with its original name.
• dig example.com ANY and host example.com query DNS. dig +short gives you just the answer, which is what you want inside a script.
• nc -lvnp 4444 opens a listener on port 4444. This is the receiving end of nearly every reverse shell you will catch.

One thing worth internalizing early: ss -tulpn run on a machine you already have a shell on tells you about services bound to localhost, which no external port scan will ever see. That gap between what nmap sees from outside and what ss sees from inside is where a lot of CTF boxes hide their second act. Our Nmap cheat sheet covers the outside view.

Processes, Services, and Packages

Once you are on a box, you want to know what is running and who is running it.

• ps aux lists every running process with its owner and full command line. Pipe it to grep to filter: ps aux | grep apache.
• top is the live view. Install htop if you want it to be pleasant to read.
• kill -9 PID force-terminates a process. Try plain kill PID first so the process gets to clean up.
• systemctl status ssh checks a service. Swap in start, stop, or enable. Kali does not start most services at boot, which is why your Postgres-backed Metasploit database is empty until you say sudo systemctl start postgresql.
• sudo apt install package installs software, apt search term finds it, and apt show package tells you what it is before you commit.
• which nmap and whereis nmap tell you if a binary exists and where. On a target, which python3 curl wget nc in one line tells you what you have to work with.

A detail beginners miss: the full command line in ps aux sometimes contains passwords, because somebody wrote a cron job that calls mysql -u root -phunter2. Read the output, do not just scan it for process names.

The Kali Tool Commands Worth Learning First

Kali ships several hundred tools. You need five of them to start, and adding more before you understand these five slows you down rather than speeding you up.

The wordlist paths are worth committing to memory, because every tutorial assumes you know them. Kali keeps wordlists in /usr/share/wordlists/, and rockyou.txt ships compressed. Run sudo gunzip /usr/share/wordlists/rockyou.txt.gz once and it is there for good.

My honest advice on Metasploit: learn nmap, gobuster, and manual exploitation first. Metasploit is excellent, and starting with it teaches you to search for a module instead of understanding a vulnerability. That habit falls apart the first time no module exists.

Chaining Commands: Where Kali Gets Fast

Individual commands are the alphabet. Chaining is the language, and it is the difference between typing at a terminal and working at one.

• | pipes one command's output into the next: cat access.log | grep 404 | wc -l counts your 404s.
• > writes output to a file and overwrites it. >> appends instead. Use >> unless you mean to destroy the file.
• && runs the next command only if the previous one succeeded. || runs it only if the previous one failed.
• ; runs commands in sequence regardless of success.
• sort -u sorts and removes duplicates, which is how you clean up a scraped list of subdomains.
• cut -d: -f1 splits each line on a delimiter and keeps one field. cut -d: -f1 /etc/passwd gives you a clean username list.
• tee file writes to a file and to the screen at the same time, so you keep a record without going blind.

Here is a chain that does something real. It pulls usernames out of /etc/passwd, keeps only accounts with a login shell, and saves the list for a password attack:

grep "sh$" /etc/passwd | cut -d: -f1 | sort -u | tee users.txt

Four commands, one line, no tool required. Building chains like this is the single skill that separates people who are comfortable in a shell from people who are not, and it is why the boring file commands earlier in this article matter more than the flashy ones.

Kali Linux Commands Cheat Sheet

Everything above in one table. Keep it open in a second tab for your first few boxes.

Legal and Ethical Considerations

• Practice on systems built for it: purpose-built training platforms, a local VM you own, or a scoped bug bounty program.
• Reading files, listing processes, and checking your own IP are harmless. Brute forcing a login is not. Know which side of that line each command sits on.
• A CTF's rules are part of its scope. Attacking the scoreboard, other players, or infrastructure outside the listed targets gets people banned and occasionally prosecuted.
• If you find something real on a system you were not testing, stop, do not touch the data, and report it through the organization's disclosure channel.

Frequently Asked Questions