Bash Scripting Primer

A great deal of penetration testing is gluing existing tools together: run curl against a list of paths, feed a wordlist into a loop, save the interesting lines, repeat. The shell you already type commands into — Bash — is also a full programming language, and a five-line Bash script often beats a Python program when the job is "run these commands in a loop and look at the output". This is the shell-glue half of the scripting track, for someone who can run a few commands but has never written a script.

python-primer handles logic and HTTP through the requests library. The rule of thumb: reach for Bash when you are chaining command-line tools (curl, grep, nmap), and Python when you need real data structures, JSON parsing, or anything that gets fiddly in the shell. Both feed programming-scripting-for-pentesters.

In this lesson you will:

• Make a text file executable with a shebang and chmod +x.
• Use variables and learn the quoting rule that bites everyone.
• Capture a command's output with command substitution ($(...)).
• Write **for and while loops, branch with if and the [ ... ] test, and chain commands on success/failure with exit codes and && / ||**.
• Put it together into a real content-discovery loop that curls a list of paths and prints each status code.

Making a file a script: the shebang and chmod +x

A Bash script is just a text file. Two things turn it into something you can run directly:

• A shebang on the very first line — #!/usr/bin/env bash — which tells the kernel which interpreter to use.
• The execute bit, set with chmod +x script.sh, which marks the file as runnable.

#!/usr/bin/env bash
echo "hello from a script"

chmod +x hello.sh
./hello.sh            # runs it

Without the execute bit you can still run it explicitly with bash hello.sh, but the shebang plus chmod +x is the clean, portable habit.

Variables and quoting

Assign with **no spaces around the =**, and read back with a $:

target="https://target.example"
echo "$target"

Quoting is the single thing that bites everyone. Wrap variables in double quotes ("$target") so spaces and special characters survive as one value. Use single quotes ('...') when you want the text completely literal, with no $ expansion at all. Forgetting the quotes is the most common Bash bug there is.

When you are ready, send Continue and we will add loops, conditionals, and the operators that chain commands.