Bash Pentesting Lab

Bash as a Security Toolkit

If you have only ever used a graphical user interface to interact with a computer, you may be surprised by how much a security professional can accomplish with nothing but a terminal prompt and a handful of text-processing commands. This lesson introduces Bash — the Bourne Again Shell — as a practical toolkit for reconnaissance, enumeration, and post-exploitation tasks during a security assessment.

What is Bash?

Bash is a command-line interpreter available on virtually every Linux and macOS system. When you open a terminal, Bash is the program reading your commands and executing them. It is far more than a simple command runner — Bash is a full scripting language with variables, loops, conditionals, and functions. Penetration testers use it because:

• It is always present on Linux targets without any installation step.
• It composes small, focused tools into powerful pipelines using the | (pipe) operator.
• It handles file system traversal, text processing, and network queries with equal ease.
• Scripts written in Bash run the same way on any POSIX-compliant system.

Essential Commands for Security Work

find — Locate Files by Attribute

find searches the file system for files matching criteria you specify. It is indispensable for enumeration:

# Find all files larger than 1 MB owned by root
find / -type f -size +1M -user root 2>/dev/null

# Find all world-writable directories
find / -type d -perm -o+w 2>/dev/null

# Find configuration files by extension
find /etc -name "*.conf" -type f 2>/dev/null

The 2>/dev/null suffix redirects error messages (such as "Permission denied") to the null device, keeping the output clean.

grep — Search Inside Files

grep searches text for lines matching a pattern. With the -o flag it prints only the matching portion, and with -E it interprets the pattern as an extended regular expression:

# Extract all email addresses from a log file
grep -oE "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}" access.log

# Find lines containing "password" (case-insensitive)
grep -i "password" /etc/config/*.conf

# Recursively search all PHP files for dangerous functions
grep -rn "eval(" /var/www/html --include="*.php"

awk — Column-Oriented Text Processing

awk processes text line by line and has built-in awareness of whitespace-separated columns. It is the tool of choice for extracting specific fields from structured output:

# Print the first column (IP address) from an access log
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn

# Print lines where the response code (column 9) is 500
awk '$9 == 500' /var/log/nginx/access.log

ss and netstat — Network Socket Enumeration

ss (socket statistics) and its older counterpart netstat list active network connections and listening ports. During a security assessment, listing listening ports reveals which services are running and whether any are bound to all interfaces versus localhost only:

# List all listening TCP sockets with process names
ss -tlnp

# Equivalent using netstat
netstat -tlnp

The flags mean: -t (TCP only), -l (listening sockets only), -n (numeric output, do not resolve hostnames), -p (show the process name).

SUID Files — A Privilege Escalation Target

SUID stands for Set User ID on execution. When a file has the SUID permission bit set, it executes with the privileges of its owner rather than the privileges of the user who launched it. On most Linux systems, files like /usr/bin/passwd are owned by root and carry the SUID bit — this allows ordinary users to change their own password, because passwd temporarily runs as root to write to /etc/shadow.

The danger: if a SUID binary owned by root contains a vulnerability — a buffer overflow, command injection, or unsafe use of a system call — an attacker who exploits it gains root privileges. Even a fully patched system accumulates SUID files over time as packages are installed.

The command to discover SUID files is:

find / -perm -u=s -type f 2>/dev/null

Alternatively, using the octal representation:

find / -perm -4000 -type f 2>/dev/null

Both commands produce the same output. The -perm -u=s form is more readable; the -perm -4000 form uses the octal value of the SUID bit directly.

What You Will Do in This Lesson

You will use a simulated Bash terminal to complete five enumeration challenges:

1. Discover all SUID files on the system.
2. Locate hidden .env files that may contain secrets.
3. Extract email addresses from a web server access log.
4. Enumerate all listening TCP ports and identify running services.
5. Find files modified in the last 24 hours to detect recent changes.

Each command you run will be evaluated against the challenge criteria. When all five challenges are complete, proceed to the payload submission step where you will demonstrate the SUID discovery command.