SEC GUY / JOB READY / COMMAND-LINE LAB

Command line.
Clear thinking.

Move from memorizing commands to reading evidence. Ten guided, browser-based scenarios build the habits behind practical security work.

10 SIMULATED SCENARIOSMOBILE FRIENDLYNO SHELL EXECUTION
SCENARIO 01 / LOG HUNTER

Find the signal in the noise.

An SSH auth log can place the source IP in different whitespace fields. Filter by the event, then extract the address after the word "from" instead of assuming every line has the same field number.

SIMULATED AUTH.LOG
Jan 29 08:05 server sshd: Failed password for invalid user admin from 192.168.1.10 port 51234 Jan 29 08:07 server sshd: Failed password for root from 10.0.0.5 port 44421 Jan 29 08:11 server CRON: backup complete Jan 29 08:13 server sshd: Failed password for test from 203.0.113.9 port 33455

Static sample data. No command executes on a server or your computer.

ANALYST OUTPUTSelect an action to investigate.INTERVIEW TAKEAWAY

"I filtered failed authentication events, extracted the source addresses, and verified the parsing against more than one log format."

What to notice: The phrase "invalid user" shifts the fields. A fixed awk '{print $11}' may return a username or other token on some lines.
THE PROFESSIONAL HABIT

Inspect. Act. Verify.

The best Bash workflow is not a command list. It is a repeatable decision loop with bounded actions and evidence at every step.

01 / INSPECT

Read the current state

Start from logs, permissions, processes or files. Know what you are about to change.

02 / ACT

Make the smallest change

Use a command that matches the observed problem and the approved scope.

03 / VERIFY

Check the result

Re-run a read-only inspection and confirm the intended state changed.

TEN SCENARIOS / ONE INVESTIGATOR

Choose your next mission.

The live page already contains ten simulations. This redesign organizes them into a scan-friendly route while preserving the original exercises for integration QA.

01 / INVESTIGATE

Log Hunter

Extract source IPs from failed SSH logins and explain why fixed field numbers can break.

02 / HARDEN

Permissions Audit

Spot an over-permissive config file, propose least-privilege permissions, then verify.

03 / FIND

Shadow Finder

Locate hidden and recently changed files in a simulated filesystem.

04 / IDENTITY

User Investigator

Identify an unexpected UID 0 account in a sample passwd file.

05 / CONFIG

Configuration Hardener

Inspect and safely change a sample SSH configuration value.

06 / PROCESS

Runaway Process

Identify a simulated process by PID before taking action.

07 / EVIDENCE

Evidence Collector

Package case files and inspect the archive without changing the source.

08 / LOGIC

Red Alert Script

Use conditional logic to branch on a simulated compromise indicator.

09 / LOOPS

Mass Sweeper

Repeat a safe, visible action across a sample list of indicators.

10 / CAPSTONE

First Responder

Combine detection, investigation and verification in one bounded simulation.

KEEP THE MOMENTUM

Turn practice into proof.

Carry the same inspect-act-verify discipline into Python and AI security work.

Explore Experience Builder