Preface
What is of the greatest importance in war is extraordinary speed: one cannot afford to neglect opportunity.
Sun Tzu, The Art of War
In this day and age, the command line is sometimes overlooked. New cybersecurity practitioners may be lured away by tools with flashy graphical interfaces. More-experienced operators may dismiss or underestimate its value. However, the command line provides a wealth of capability and should be part of every practitioner’s toolkit. As an example, the seemingly simple tail command that outputs the last few lines of a specified file is over 2,000 lines of C code. You could create a similar tool using Python or another programming language, but why do so when you can access its capabilities by simply invoking it from the command line?
Additionally, learning how to use the command line for complex tasks gives you a better understanding of the way an operating system functions. The most capable cybersecurity practitioners understand how tools work at a fundamental level, not just how to use them.
Cybersecurity Ops with bash teaches you how to leverage sophisticated Linux commands and the bash shell to enhance your capabilities as a security operator and practitioner. By learning these skills you will be able to rapidly create and prototype complex capabilities with as little as a single line of pipelined commands.
Although the bash shell and the commands we discuss throughout this book originated in the Unix and Linux family of operating systems, they are now ubiquitous. The techniques are easily transferable between Linux, Windows, and macOS environments.
Who This Book Is For
Cybersecurity Ops with bash is written for those who wish to achieve mastery of the command line in the context of computer security. The goal is not to replace existing tools with command-line scripts, but rather to teach you how to use the command line so you can leverage it to augment your existing security capabilities.
Throughout this book, we focus examples on security techniques such as data collection, analysis, and penetration testing. The purpose of these examples is to demonstrate the command line’s capabilities and give you insight into some of the fundamental techniques used by higher-level tools.
This book assumes basic familiarity with cybersecurity, the command-line interface, programming concepts, and the Linux and Windows operating systems. Prior knowledge of bash is useful but not necessarily needed.
This book is not an introduction to programming, although some general concepts are covered in Part I.
Bash or bash
Throughout this book, we refer to the bash shell by using a lowercase letter b unless it is the first word in a sentence or is referencing the Windows program Git Bash. This convention is based on guidance provided by Chet Ramey, who is the current maintainer of the software. For more information on bash, visit the bash website. For more information on the various releases of bash, reference documentation, and examples, visit the bash Cookbook wiki page.
Script Robustness
The example scripts in this book are written to illustrate and teach concepts. The scripts are not designed to be efficient or robust enough for enterprise deployment. Use caution if you choose to use the scripts in a live environment. Be sure to follow programming best practices and test your scripts before deployment.
Workshops
We provide thought-provoking questions and practice problems at the end of each chapter to help you build your security, command-line, and bash skills. You can find solutions to some of these exercises and additional resources at the Cybersecurity Ops website.
Conventions Used in This Book
The following typographical conventions are used in this book:
- Italic
-
Indicates new terms, URLs, email addresses, filenames, and file extensions.
Constant width-
Used for program listings, as well as within paragraphs to refer to program elements such as variable or function names, databases, data types, environment variables, statements, and keywords.
Constant width bold-
Shows commands or other text that should be typed literally by the user.
Constant width italic-
Shows text that should be replaced with user-supplied values or by values determined by context.
Tip
This element signifies a tip or suggestion.
Note
This element signifies a general note.
Warning
This element indicates a warning or caution.
Using Code Examples
This book is here to help you get your job done. In general, if example code is offered with this book, you may use it in your programs and documentation. You do not need to contact us for permission unless you’re reproducing a significant portion of the code. For example, writing a program that uses several chunks of code from this book does not require permission. Selling or distributing a CD-ROM of examples from O’Reilly books does require permission. Answering a question by citing this book and quoting example code does not require permission. Incorporating a significant amount of example code from this book into your product’s documentation does require permission.
We appreciate, but do not require, attribution. An attribution usually includes the title, author, publisher, and ISBN. For example: “Cybersecurity Ops with bash by Paul Troncone and Carl Albing (O’Reilly). Copyright 2019 Digadel Corp & Carl Albing, 978-1-492-04131-3.”
If you feel your use of code examples falls outside fair use or the permission given above, feel free to contact us at [email protected].
O’Reilly Online Learning
Note
For almost 40 years, O’Reilly Media has provided technology and business training, knowledge, and insight to help companies succeed.
Our unique network of experts and innovators share their knowledge and expertise through books, articles, conferences, and our online learning platform. O’Reilly’s online learning platform gives you on-demand access to live training courses, in-depth learning paths, interactive coding environments, and a vast collection of text and video from O’Reilly and 200+ other publishers. For more information, please visit http://oreilly.com.
How to Contact Us
Please address comments and questions concerning this book to the publisher:
- O’Reilly Media, Inc.
- 1005 Gravenstein Highway North
- Sebastopol, CA 95472
- 800-998-9938 (in the United States or Canada)
- 707-829-0515 (international or local)
- 707-829-0104 (fax)
We have a web page for this book, where we list errata, examples, and any additional information. You can access this page at http://bit.ly/cybersecurity-ops-bash.
To comment or ask technical questions about this book, send email to [email protected].
For more information about our books, courses, conferences, and news, see our website at http://www.oreilly.com.
Find us on Facebook: http://facebook.com/oreilly
Follow us on Twitter: http://twitter.com/oreillymedia
Watch us on YouTube: http://www.youtube.com/oreillymedia
Acknowledgments
We would like to thank our two primary technical reviewers for their insight and for helping us to ensure the accuracy of this book and maximum value to the reader. Tony Lee, Senior Technical Director at Cylance Inc., is a security enthusiast who regularly shares knowledge at LinkedIn and SecuritySynapse. Chet Ramey, Senior Technology Architect in the Information Technology Services division of Case Western Reserve University, is the current maintainer of bash.
Thank you also to Bill Cooper, Josiah Dykstra, Ric Messier, Cameron Newham, Sandra Schiavo, and JP Vossen for their guidance and critiques.
Finally, we would like to thank the entire O’Reilly team, especially Nan Barber, John Devins, Mike Loukides, Sharon Wilkey, Ellen Troutman-Zaig, Christina Edwards, and Virginia Wilson.
Disclaimer
The opinions expressed in this book are the authors’ own and do not reflect the view of the United States government.