4.2 The Command Line

Shells and Terminal Emulators

A shell is the command-line interpreter: it reads what you type, finds and launches the program you named, and displays the result. Kali's default interactive shell has been zsh (Z shell) since release 2020.4, chosen for its powerful completion and globbing features. bash (Bourne Again Shell) is still installed and remains what most tutorials and scripts assume. A third shell, dash (Debian Almquist Shell), is what /bin/sh points to: it is a small, fast, strictly POSIX (Portable Operating System Interface)-compliant shell used to run system scripts at boot, where startup speed matters and interactive features do not. Do not confuse the shell with the terminal emulator — the graphical window (on the default Kali desktop, qterminal) that merely draws text and forwards keystrokes to the shell running inside it. Exam questions love this distinction: the terminal is the window, the shell is the program interpreting commands.

Command Syntax: command, Options, Arguments

Nearly every command follows the same grammar:

command [options] [arguments]

• The command names the program to run (or a shell built-in such as cd).
• Options modify behavior. Traditional short options take a single dash and one letter (ls -l), GNU-style long options take a double dash and a word (ls --all), and short options usually bundle (ls -la equals ls -l -a).
• Arguments are the targets the command acts on, most often file or directory names.

Read man ls or run ls --help to see a command's full option set. Two conventions worth memorizing: a bare - often means standard input or output, and -- by itself marks the end of options so a file named -rf can be handled safely.

Paths: Absolute vs. Relative

An absolute path always starts at the root directory / and works from anywhere — /etc/passwd means the same thing no matter where you are. A relative path is resolved against your current working directory (shown by pwd and changeable with cd). Three shortcuts appear constantly:

• . — the current directory (./script.sh runs a script located here, which is required because . is deliberately not in PATH for security)
• .. — the parent directory (cd .. moves up one level)
• ~ — your home directory, expanded by the shell (cd ~/Downloads)

Spaces and special characters in names must be quoted or escaped: cd My\ Documents or cd 'My Documents'.

Tab Completion and History

zsh and bash save enormous typing. Press Tab once to complete an unambiguous command or file name; press it twice to list candidates when the prefix is ambiguous. zsh completes not just files but command names, options, usernames, hostnames, and package names.

The shell also remembers what you ran. The Up arrow steps backward through previous commands, the history built-in prints the numbered list, and !42 re-executes entry 42 (!! repeats the last command). The most useful trick is Ctrl+R, which starts a reverse incremental search: type any fragment of a past command and the shell finds the most recent match, which is ideal for resurrecting a long nmap invocation. History lives in memory per session and is written to a file on exit — ~/.zsh_history for zsh, ~/.bash_history for bash.

Environment Basics

Every process runs with a set of environment variables — name/value pairs that configure behavior. Display one with echo $HOME or list them all with printenv. The variable you will meet most on the exam is PATH: the colon-separated list of directories the shell searches, in order, when you type a command name without a path. That is why nmap works from anywhere (it sits in a PATH directory such as /usr/bin) but ./exploit.py needs an explicit path when the current directory is not in PATH.

Setting a variable with EDITOR=nano affects only the current shell. To pass it to programs launched from the shell, you must export it: export EDITOR=nano (or export EDITOR after assignment). Exported variables are copied into the environment of every child process; changes never propagate back up to the parent, which is why running a script that sets variables does not alter your interactive shell unless you source it. Common variables worth recognizing include HOME (your home directory), USER (your login name), SHELL (your login shell), PWD (current directory), LANG (locale), and PS1 (the prompt string). Permanent changes go in your shell's startup file — ~/.zshrc on a default Kali — rather than being typed each session.

Getting Help and Knowing What You Are Running

Before guessing at options, use the built-in documentation. man ls opens the manual page for a command (navigate with the same keys as less, search with /, quit with q), and man pages are organized into numbered sections — section 1 for user commands, 5 for file formats like man 5 passwd, 8 for administration commands. Most programs also answer command --help with a quick usage summary, and apropos keyword (equivalent to man -k) searches man page descriptions when you know the task but not the tool name.

Not every command name maps to a program on disk. The shell distinguishes four kinds: external programs found via PATH (like nmap), shell built-ins executed by the shell itself (cd, echo, export, history — they must be built-ins because they affect the shell's own state), aliases (shortcuts you define, such as alias ll='ls -la'), and functions. Run type name to see which one you are dealing with; this matters because a built-in has no file for which to find, and because a command can behave differently depending on which shell interprets it — a zsh built-in's flags are not guaranteed to match dash's.