The First Thing Hackers Do...

Hackers don't break into a system and start clicking random files. The first thing they do is gather information. In this video, I walk through some of the most common Linux commands used to understand what’s happening on a system—from identifying running processes to seeing what services are exposed. Whether you’re learning cybersecurity, working in IT, or just curious how attackers think, understanding these commands can help you better defend your own systems. Remember: Knowing how attackers think is the first step to defending yourself. The first thing hackers do is not steal files. They learn everything about the system first. The first thing they're most likely to do is to run 'ps aux', and 'ps' stands for process status. It lists every running process, who started it, and how many resources it's using. If something looks interesting, this is usually where they'll spot it. The next one we're gonna run is 'htop'. This is the classic 'top' command. It gets its name because 'top' processes that are consuming system resources. The next likely command they're probably run is 'lsof', which stands for list open files. In Linux, almost everything is treated like a file, including devices and network connections. This command shows what files and resources are currently open by running processes. The next one we're gonna run is 'netstat -an | grep LISTEN'. 'Netstat' stands for network statistics. It displays the ports currently listening for incoming connections, giving a quick look at what services are exposed on the system. The first thing an attacker wants isn't control, it's information. Every running process, every open port, and every detail tells part of the story. The more they understand the system, the easier it becomes to plan the next move. Follow for more cybersecurity tips.