Every serious security tool runs in a terminal. Nmap, sqlmap, ffuf, Burp Suite's CLI, Metasploit — none of them have nice GUIs you click through. The terminal is where the real work happens.

But beyond tooling, understanding the terminal means understanding the systems you're attacking. When you get command injection on a server, you need to know what to do once you have a shell. When you find a file inclusion bug, you need to know what files are worth reading. When you're doing recon, you need to automate things with scripts.

Linux — why not Windows?

Almost every server on the internet runs Linux. Web apps, databases, APIs, cloud infrastructure — Linux. When you compromise a system and get a shell, it will almost certainly be a Linux shell. Even the attack machines you use to run your tools from are Linux.

Windows matters too — Active Directory, Windows privilege escalation — but Linux is the foundation. Learn this first.

The shell

The program that interprets your commands is called a shell. The most common shell on Linux is bash (Bourne Again Shell). When you open a terminal on a Linux machine, you're running bash by default. You'll also encounter sh, zsh, and fish — but bash is what you need to know.