Kali Linux Commands Cheat Sheet 2026 — 200+ Commands with Examples (The Only Reference You’ll Ever Need)

This article presents a comprehensive reference guide of 200+ Kali Linux commands organized across 10 categories (system navigation, networking, Nmap, web testing, password cracking, Metasploit, wireless security, forensics, post-exploitation, and utilities), each with real working examples and plain-English explanations. The author positions this as a current, practitioner-written alternative to outdated search results, designed specifically for penetration testers and ethical hackers conducting authorized security testing. The guide emphasizes real-world usage patterns from actual penetration testing engagements rather than theoretical or auto-generated command lists.

• Organized workflow across attack phasesThe 10 categories follow a logical penetration testing progression: system setup, network reconnaissance (Nmap, DNS, routing), vulnerability discovery (web fuzzing, SQL injection scanning), credential attacks (John, Hashcat, Hydra), exploitation (Metasploit), and post-compromise actions (privilege escalation, forensics). This structure mirrors how commands are actually used sequentially in authorized engagements, not as isolated tools.
• Nmap positioned as foundational reconnaissanceNmap receives dedicated treatment with a complete command reference including scan types (SYN, UDP, ping sweep), port specifications (single, ranges, top ports), output formats, and NSE vulnerability scripts. The article highlights a 'professional scan combo' (nmap -sV -sC -O -p- -T4 -oA) that penetration testers reportedly run on every authorized target, establishing it as essential baseline reconnaissance.
• Web application testing automation emphasisThe web testing section covers Gobuster for directory enumeration with wordlist examples, ffuf for fast fuzzing with authentication headers, Nikto for automated vulnerability scanning, SQLmap for SQL injection detection with database dumping, and Subfinder combined with httpx for subdomain discovery. Each tool is presented with real parameter usage reflecting actual engagement workflows.
• Password cracking methodology comparisonThree distinct password attack methods are presented: John the Ripper for offline hash cracking with format auto-detection and combined passwd/shadow files, Hashcat for GPU-accelerated attacks with hash mode codes (MD5, NTLM, bcrypt) and brute-force patterns, and Hydra for online brute-force against SSH, FTP, HTTP, and RDP services. Each tool addresses different attack scenarios based on access level.
• Post-exploitation privilege escalation checksLinux privilege escalation commands check for sudo permissions, SUID binaries using find with permission flags (-perm -4000), cron job execution, process ownership, environment variables containing credentials, and bash history. The article also references LinPEAS automated enumeration and Meterpreter post-session commands like getsystem and hashdump for Windows privilege escalation after initial compromise.
• Wireless testing complete WPA2 workflowThe Aircrack-ng suite section outlines the full WPA2 attack chain: enabling monitor mode with airmon-ng, network discovery with airodump-ng, channel and BSSID targeting, deauthentication attacks to force handshake capture, and wordlist-based cracking of captured handshakes. This presents the complete workflow for testing wireless networks in authorized scenarios.
• Forensics and file analysis techniquesDigital forensics commands cover file type identification via magic bytes (file command), string extraction from binaries, hexadecimal examination, hash generation for evidence integrity (MD5, SHA256), metadata extraction from images (exiftool), binary firmware analysis and extraction (binwalk), and memory dump analysis (volatility). These support evidence collection and analysis in post-compromise investigations.
• Shell and text processing power toolsThe utilities section emphasizes everyday penetration tester skills: grep for recursive pattern searching across files, awk for columnar data extraction, cut for field extraction from delimited files, sort with deduplication, wc for line counting, tee for simultaneous file writing and display, xargs for batch command execution, and base64 encoding/decoding. These form the foundation for data processing in engagement workflows.

Bottom line: This cheat sheet consolidates the actual commands and workflows used in real penetration testing engagements across reconnaissance, vulnerability assessment, exploitation, and post-compromise phases, with every command tested and explained for immediate practical application in authorized security testing. The emphasis on real working examples, tool combinations, and current Kali Linux versions makes it a reference for practitioners rather than abstract command documentation.