This article provides a comprehensive guide to the Linux filesystem structure and its security implications for ethical hackers. It explains the Filesystem Hierarchy Standard (FHS) that governs all Linux distributions, walks through critical directories and their contents, and teaches penetration testers where to find sensitive files, credentials, and evidence of system activity. Understanding the Linux filesystem map is presented as foundational knowledge that separates effective security professionals from those who struggle on unfamiliar systems.
- FHS provides predictable file locations across distributionsThe Filesystem Hierarchy Standard ensures that files in /etc on Ubuntu, Kali, and Raspberry Pi behave identically, with everything in Linux starting at the root directory / and branching into a consistent tree structure with no drive letters like Windows. This standardization means knowledge gained on one Linux system transfers directly to any other Linux system encountered.
- /etc contains system configuration and credentials/etc is the highest-security-relevance directory, holding /etc/passwd (user accounts), /etc/shadow (password hashes readable only by root), /etc/group (group memberships), /etc/ssh/sshd_config (SSH server settings), and /etc/crontab (scheduled root tasks). The article demonstrates that misconfigurations like 'PermitRootLogin yes' in sshd_config create exploitable vulnerabilities, and accessing /etc/shadow signifies privilege escalation has already occurred.
- /home reveals credentials through command history and keysUser home directories contain .bash_history (command history often containing passwords and internal IPs), .ssh/id_rsa (private SSH keys for lateral movement), .ssh/authorized_keys (who can log in as that user), and config files with embedded credentials. The article identifies .bash_history as one of the most valuable files because users frequently type passwords, hostnames, and credentials directly into the terminal.
- /var logs system activity and contains web application files/var/log/auth.log records login attempts and sudo usage, /var/log/syslog captures general system activity, web server logs show visitor patterns, and /var/www/html contains web application files often with hardcoded database credentials in config.php. This directory is critical both for understanding what happened on a system and for finding web application vulnerabilities.
- /tmp world-writable nature enables tool staging and creates risksAny user can write to /tmp without elevated privileges, making it useful for staging uploaded exploits and tools during assessments. However, the same open permissions enable attackers to hide payloads, perform symlink attacks, and exploit race conditions for privilege escalation. The sticky bit prevents users from deleting each other's files, and /var/tmp persists across reboots while /tmp clears.
- /proc virtual filesystem provides live system reconnaissance/proc is generated live by the kernel and contains no files on disk; it reveals /proc/cpuinfo (CPU details), /proc/meminfo (memory usage), /proc/version (kernel version), numbered directories for each running process with their PID, /proc/net/tcp for active network connections, and /proc/[PID]/environ for process environment variables that may contain secrets. This allows complete system enumeration using only cat and ls when standard tools are unavailable.
- Specific sensitive file locations are recon checkpointsThe article provides a structured reference of critical files organized by function: credentials in /etc/passwd, /etc/shadow, and ~/.ssh/id_rsa; configuration with embedded credentials in web app files and MySQL configs; activity logs in /var/log/auth.log and /var/log/syslog; and privilege escalation targets in /etc/cron.d, /etc/sudoers.d, and SUID binaries found via find / -perm -4000. This prioritized list serves as a template for every system assessment.
- /usr/share contains wordlists and exploit frameworks in KaliKali-specific paths like /usr/share/wordlists/rockyou.txt (for password attacks), /usr/share/nmap/scripts/ (NSE scripts), /usr/share/metasploit-framework/modules/ (exploit modules), and /usr/share/webshells/ (payload templates) are embedded in the filesystem structure and become essential tools as the course progresses through later days covering password attacks and exploitation.
Bottom line: The Linux filesystem follows a standard, predictable structure governed by FHS where sensitive credentials, logs, configurations, and exploitable services live in known locations; mastering these locations and what each directory contains transforms Linux from a black box into a navigable map that reveals exactly what to target during penetration testing or system assessment. The article provides a reference framework and practical commands (like find / -perm -4000 for SUID binaries and cat ~/.b
Day 100 — Professional Pentester
This lesson has two audiences and both of them are you — the student and the future professional. As a student, you need to navigate Kali comfortably and understand where your tools, configs, and files live. As a penetration tester, you need to know exactly where to look when you land on an unfamiliar Linux system. Same knowledge, two applications. Let’s build it.
The FHS — Linux’s Master Plan
Linux systems follow the Filesystem Hierarchy Standard (FHS) — an agreed-upon structure that defines where different types of files should live. This is why a file you find in /etc on an Ubuntu server, a Kali VM, and a Raspberry Pi all behave the same way. The standard applies across almost all Linux distributions.
Everything in Linux starts at / — called “root” (not to be confused with the root user). It’s the top of the directory tree. Every single file on a Linux system — regardless of what physical disk or partition it’s on — exists somewhere under /. There are no drive letters like Windows. One tree. Everything in it.
Root-Level Directories — What Each One Does
Before we go deep into the most important directories, here is a clean reference for every root-level folder. I want you to understand the purpose of each one — not memorise the tree, but know instinctively where to look for any type of file.
| Directory | Purpose | Security Relevance |
|---|---|---|
| /etc | System-wide configuration files | 🔴 Highest — credentials, users, services |
| /home | User home folders (/home/username) | 🟡 High — SSH keys, browser data, files |
| /var | Variable data — logs, databases, web | 🟡 High — logs reveal activity, web files |
| /tmp | Temporary files — world-writable | 🟣 Medium — tool upload staging area |
| /proc | Live kernel/process data (virtual) | 🔵 Medium — enumerate processes, network |
| /root | Home directory of the root user | 🔴 Critical — root’s files, history, keys |
| /usr | User programs and libraries | 🔘 Low — installed tools, exploits here |
| /bin | Essential user binaries (ls, cat, cp) | 🔘 Low — SUID check on these |
| /sbin | System admin binaries (root tools) | 🔘 Low — check for unusual binaries |
| /dev | Device files (disks, terminals, null) | 🔘 Low — /dev/null, /dev/random useful |
| /boot | Kernel and bootloader files | 🔘 Low — kernel version fingerprinting |
| /opt | Optional third-party software | 🔘 Low — sometimes holds custom apps |
/etc
Configuration Files — The Brain of the System
/etc stands for “et cetera” historically, but in practice it means system configuration. Almost every service, program, and system setting on a Linux machine is controlled by a plain text file somewhere in /etc. This is the first directory I check on any new system — it tells me everything about what’s running and how it’s configured.
/etc/shadow is only readable by root. If you can read it on a target machine, you’ve already achieved privilege escalation. The SHA-512 hashes inside can then be cracked offline using tools like Hashcat with a wordlist — something we cover in depth on Day 10 (password attacks).
/home
User Directories — Personal Data & Secrets
Each regular user on a Linux system gets a folder under /home. This is where their personal files, application settings, and sensitive data live. In a penetration test, accessing a user’s home directory often yields credentials, private keys, and configuration files containing passwords.
.bash_history is one of the most valuable files on a system during an assessment. People type passwords, internal hostnames, and credentials directly into the terminal — and history records all of it. Always check it. And in your own lab, be mindful of what you type because history records everything.
/var
Variable Data — Logs, Web Files & Databases
/var holds data that changes continuously while the system runs — log files, mail spools, database files, and web content. For ethical hackers it has two important angles: log files reveal system activity and user behaviour, and /var/www contains the web application files you might be targeting or assessing.
/tmp
World-Writable Territory — Every User Has Access
/tmp is one of the most interesting directories from a security perspective. It is world-writable — any user on the system can create, read, and write files here, without any elevated privileges. This has important implications in both directions.
- Staging area for file transfers between machines
- Uploading tools to a compromised system (no write restrictions)
- Storing temporary outputs from scans and scripts
- Compiling small exploits or payloads during an engagement
- Attackers use /tmp to stage payloads after initial access
- Symlink attacks exploit /tmp’s open permissions
- Sensitive data written here is readable by all users
- Race conditions in /tmp can lead to privilege escalation
/proc
The Live System Window — Real-Time Kernel Data
/proc is unique — it doesn’t exist on your hard disk. It’s a virtual filesystem generated live by the Linux kernel. Every number you see as a subdirectory inside /proc is a running process’s PID (Process ID). Reading files in /proc gives you live information about the system’s state — no special tools required.
/proc lets you enumerate processes and network connections with nothing but cat and ls. In situations where ps and netstat aren’t available, /proc becomes your recon toolkit./usr, /bin, /sbin — Where Programs Live
These three directories together make up the “programs” layer of Linux. On modern systems, /bin and /sbin are often symbolic links to /usr/bin and /usr/sbin respectively — but understanding the distinction still matters for reading older documentation and working with servers.
ls, cp, mv, cat, bash. Available to all users. Check for SUID misconfigurations here.fdisk, iptables, reboot. Intended for root, though some can be run with sudo. Worth checking for unusual binaries placed here./usr/share/wordlists/ (rockyou.txt) and /usr/share/metasploit-framework/ live here — important to know from Day 10 onwards.🗺️ The Hacker’s Map — Most Sensitive Files on a Linux System
This is the section I want you to bookmark and return to every time you land on a new Linux target in your lab or during a CTF. This is not a complete list — it is the most commonly valuable list. Learning these locations is like knowing where all the rooms are before searching a building.
🎯 Day 4 Practical Task — Explore Your Own Kali Filesystem
Open your Kali terminal. Everything you need is already there. Work through each task in order — each one builds on the previous and gives you real hands-on familiarity with the directories we covered today.
cat /etc/passwd
sudo cat /etc/shadow | head -5
cat /etc/hosts
wc -l ~/.zsh_history
ls -la ~/.ssh/ 2>/dev/null
cat /proc/cpuinfo | grep “model name”
cat /proc/meminfo | grep “MemTotal”
ls /proc/ | grep -E ‘^[0-9]+$’ | wc -l
cat /etc/crontab
ls /var/log/
ls /usr/share/wordlists/
mkdir -p ~/Day4 && find / -perm -4000 2>/dev/null > ~/Day4/suid_files.txt — first real evidence file you’ve captured.Find every file on your Kali system that is writable by all users (world-writable) — not just /tmp. How many do you find? Are any of them scripts being run by cron? This is a real misconfiguration check used in professional privilege escalation enumeration.
🗺️
Linux is no longer a black box.
Four days in — you’ve built the mindset, the environment, the commands, and the map. Day 5 is where things get seriously interesting: networking fundamentals. How does the internet actually work? What is TCP/IP? What happens between your keyboard and a website? The answers change how you see every connection you’ve ever made.
Frequently Asked Questions — Day 4 Linux File System
SecurityElites — Complete Kali Linux Guide
SecurityElites — Authentication Bypass Basics for Beginners
Linux Foundation — Filesystem Hierarchy Standard (FHS 3.0) →
man7.org — /proc Filesystem Reference →
HackTricks — Linux Privilege Escalation Reference →
Knowing the filesystem is what separates a hacker who gets stuck from one who finds the path. Every system is a puzzle — and now you know where all the pieces are kept. Four days in, you’re ahead of where most people are after four months of “thinking about” starting.
1 Comment