Linux Reconnaissance Commands

Built-in Linux commands for post-exploitation situational awareness — the Linux counterpart to windows-reconnaissance-commands. These require no external tools, work on virtually any Linux system, and map to MITRE ATT&CK Discovery techniques. They are also LOLBins — living-off-the-land binaries that blend in with normal administration.

System identity

Command	Purpose
cat /etc/issue	OS distribution banner
cat /proc/version	Kernel version and build info
hostname	System hostname
uname -a	Kernel, architecture, hostname, OS

Users and privileges

Command	Purpose
cat /etc/passwd	All local user accounts
id	Current user’s UID, GID, and groups
w	Currently logged-in users and their processes
who	Logged-in users (with source IP for network sessions)
last	Recently logged-in users (with source IPs)
sudo -l	Current user’s sudo permissions — see sudo

Processes and services

Command	Purpose
ps auxfww	Full process tree
ps auxww	Detailed process listing

Network

Command	Purpose
ifconfig	Network interfaces and IPs
ip route	Routing table
netstat -ano	All listening ports and connections, no DNS resolution
netstat -i	Per-interface statistics
netstat -l	Only listening ports
netstat -p	Protocol and service info (root for full detail)
netstat -s	Protocol statistics
lsof -i	Processes using network ports (pair with netstat)

Environment and history

Command	Purpose
env	Environment variables (may contain credentials)
history	Shell command history (may contain passwords, keys, IPs)

Installed packages

Command	Purpose
dpkg -l	Installed packages (Debian-based)
rpm -qa	Installed packages (Red Hat-based) — see rpm-file-package-matching

Files and capabilities

Command	Purpose
find	Search for files (SUID, config, credentials)
getcap	List executables with POSIX capabilities
ls	Directory listing

Sources

• Discovery — MITRE ATT&CK TA0007
• LOLBAS Project Home

Defense perspective

These commands are ubiquitous and low-noise. Detection strategies:

• Auditd / Sysmon for Linux: Log execve syscalls and alert on recon patterns (sudo -l, find / -perm -4000, cat /etc/passwd)
• EDR: Baseline normal admin activity; alert on recon from unexpected service accounts or web-server users
• Honeypots: Canary files in /etc/passwd-adjacent paths or fake credentials in history

Related: windows-reconnaissance-commands, unix-permissions, bash-scripting, netcat, find-command