Linux Filesystem

Filesystem Hierarchy

Everything branches from / (root). The structure follows the FHS standard across most distros.

Directory	Purpose	Notable contents
/	Root of the filesystem	Everything lives under here
/etc	System configuration files	passwd, shadow, ssh/, crontab, hosts, fstab
/var	Variable data (logs, caches, spools)	log/, www/, mail/, tmp/
/tmp	Temporary files (world-writable, cleared on reboot)	Scratch space for scripts, exploits, uploads
/home	User home directories	~/.ssh/, ~/.bashrc, ~/.bash_history
/root	Root user’s home directory	Often has .bash_history, configs
/opt	Optional/third-party software	Manually installed apps
/usr	User binaries and libraries	bin/, sbin/, lib/, share/, local/
/bin	Essential user commands	ls, cp, cat, grep (often symlinked to /usr/bin)
/sbin	Essential system commands	iptables, fdisk, mount (often symlinked to /usr/sbin)
/dev	Device files	null, zero, random, sda, tty
/proc	Virtual filesystem — process and kernel info	cpuinfo, meminfo, version, [PID]/
/sys	Virtual filesystem — hardware/driver info	Kernel parameters, device attributes
/boot	Bootloader and kernel images	vmlinuz, grub/
/mnt	Temporary mount points	Manual mounts
/media	Removable media mount points	USB drives, CDs
/srv	Service data	Web server roots, FTP data
/run	Runtime data since last boot	PID files, sockets

---

Directories Worth Knowing for Recon / CTF

/etc — configuration goldmine

cat /etc/passwd         # User accounts (readable by all)
cat /etc/shadow         # Password hashes (root only)
cat /etc/group          # Groups and members
cat /etc/hostname       # Machine name
cat /etc/hosts          # Static hostname mappings
cat /etc/resolv.conf    # DNS servers
cat /etc/crontab        # System cron jobs
ls -la /etc/cron.*      # Cron directories
cat /etc/ssh/sshd_config # SSH server config
cat /etc/fstab          # Filesystem mounts (may reveal NFS shares)

/var — logs and runtime data

ls /var/log/            # System logs
ls /var/www/            # Web server files (if web hosting)
ls /var/spool/cron/     # Per-user crontabs
ls /var/mail/           # User mailboxes
ls /var/backups/        # Backup files

/tmp and /dev/shm — world-writable scratch space

ls -la /tmp/            # Temp files — writable by anyone
ls -la /dev/shm/        # Shared memory — tmpfs, writable, in RAM

Both are useful for staging files during exploitation. /dev/shm is in memory (fast, no disk writes).

/proc — live system info

cat /proc/version       # Kernel version
cat /proc/cpuinfo       # CPU info
cat /proc/meminfo       # Memory info
cat /proc/net/tcp       # Active TCP connections (hex-encoded)
ls /proc/[0-9]*/        # Running processes
cat /proc/self/environ  # Current process environment variables
cat /proc/self/cmdline  # Current process command line

/home — user artifacts

ls -la /home/*/         # All user home dirs
cat /home/*/.bashrc     # Shell configs
cat /home/*/.bash_history # Command history
ls -la /home/*/.ssh/    # SSH keys
cat /home/*/.ssh/authorized_keys

---

Quick Filesystem Commands

df -h                   # Disk usage by filesystem
du -sh /var/log/        # Size of a directory
mount                   # Show mounted filesystems
lsblk                   # Block devices
findmnt                 # Show mount tree

---

Links

• Filesystem Hierarchy Standard (FHS)
• hier(7) — Linux man page